ServiceNow IT Service Management Cross-Site Scripting Vulnerability

ServiceNow IT Service Management ITSM is a set of IT service management tools from ServiceNow, Inc. in the United States. The tool provides incident management, problem management, change and release management and other functions. A cross-site scripting vulnerability exists in ServiceNow IT...

CVE-2020-12261

Open-AudIT 3.3.0 allows an XSS attack after login...

CVE-2020-12261

Open-AudIT 3.3.0 allows an XSS attack after login...

Design/Logic Flaw

Open-AudIT 3.3.0 allows an XSS attack after login...

CVE-2020-12261

Open-AudIT 3.3.0 is affected by a reflected/authenticated cross-site scripting vulnerability (CVE-2020-12261). The issue arises in the web interface after login, where crafted input (e.g., payloads placed in the search path) can execute client-side scripts. Public references include Exploit-DB an...

CVE-2020-12261

Open-AudIT 3.3.0 allows an XSS attack after login...

OPENSUSE-SU-2020:0551-1 Recommended update for otrs

Otrs was updated to 5.0.42, fixing lots of bugs and security issues: https://community.otrs.com/otrs-community-edition-5s-patch-level-42/ - CVE-2020-1773 boo1168029 OSA-2020-10: Session / Password / Password token leak An attacker with the ability to generate session IDs or password reset tokens,...

CVE-2020-8477

The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code...

CVE-2020-8477

CVE-2020-8477 affects ABB System 800xA Information Manager (versions 5.1, 6.0–6.0.3.2, and 6.1). The flaw is in an auxiliary component incorporated into installations, enabling an XSS-like attack that could lead to arbitrary code execution on an authenticated local user. Technical details from mu...

CVE-2020-11888

python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute...

CVE-2020-10687

A flaw was discovered in Undertow where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from...

Topcoder: SVG file upload leads to XML injection

Summary: Upload Avatar option allows the user to upload image/ . Thus enabling the upload of many file formats including SVG files MIME type: image/svg+xml SVG files are XML based graphics files in 2D images. Thus, this opens up an attack vector to upload specially crafted malicious SVG files. Th...

Cross-site Scripting (XSS)

mailman is vulnerable to cross-site scripting XSS. The vulnerability exists as multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of...

Arbitrary File Read

thunderbird is vulnerable to arbitrary file read. Two flaws were found in the way Thunderbird displayed blocked popup windows. If a user can be convinced to open a blocked popup, it is possible to read arbitrary local files, or conduct an XSS attack against the user...

CVE-2018-14655

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'responsemode=formpost' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login...

CVE-2020-3902

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Processing maliciously crafted web content may lead to a cross site...

CVE-2020-10509

Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting XSS, attackers can inject arbitrary command into the system and launch XSS attack...

CVE-2020-7481

A CWE-79:Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists Andover Continuum All versions, which could enable a successful Cross-site Scripting XSS attack when using the products' web server...

CVE-2020-7481

The CVE-2020-7481 entry concerns Schneider Electric’s Andover Continuum (all versions) with a Cross-site Scripting (XSS) vulnerability in the product’s web server, caused by improper neutralization of input during web page generation. This affects the web-facing component and could allow attacker...

SQL injection relating to data display

PMASA-2020-4 Announcement-ID: PMASA-2020-4 Date: 2020-03-20 Updated: 2020-03-22 Summary SQL injection relating to data display Description An SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results. The attac...