2589 matches found
CVE-2020-10509
Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting XSS, attackers can inject arbitrary command into the system and launch XSS attack...
CVE-2020-7481
The CVE-2020-7481 entry concerns Schneider Electric’s Andover Continuum (all versions) with a Cross-site Scripting (XSS) vulnerability in the product’s web server, caused by improper neutralization of input during web page generation. This affects the web-facing component and could allow attacker...
CVE-2020-7481
A CWE-79:Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists Andover Continuum All versions, which could enable a successful Cross-site Scripting XSS attack when using the products' web server...
SQL injection relating to data display
PMASA-2020-4 Announcement-ID: PMASA-2020-4 Date: 2020-03-20 Updated: 2020-03-22 Summary SQL injection relating to data display Description An SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results. The attac...
PT-2020-6957 · Red Hat +4 · Resteasy +4
Name of the Vulnerable Software and Affected Versions: RESTEasy versions prior to 3.11.1.Final RESTEasy versions prior to 4.5.3.Final Description: A cross-site scripting XSS flaw was found in RESTEasy, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An...
Design/Logic Flaw
OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section...
CVE-2020-1761
A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this flaw to get the access token via physical access, or an XSS attack on the victim's browser...
PT-2020-12136 · Chadha · Chadha Phpkb Standard Multi-Language
Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to inject arbitrary web script or HTML via the p parameter in the admin/edit-glossary.php file. This enables reflected XSS attacks. Recommendations: For...
PT-2020-12139 · Chadha · Chadha Phpkb Standard Multi-Language
Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to inject arbitrary web script or HTML via the sort parameter in the "admin/manage-departments.php" page. This enables reflected XSS attacks...
XSS vulnerability in the FortiManager via the buffer parameter
An improper neutralization of input vulnerability in FortiManager GUI may allow an authenticated attacker to perform an XSS Cross Site Scripting attack via the buffer parameter...
CVE-2020-3157
Cisco ISE (Identity Services Engine) web-based management interface is vulnerable to Cross-Site Scripting (XSS) due to insufficient validation of user-supplied input. An authenticated attacker with write permissions can craft and save a malicious configuration, enabling script execution in the ad...
Cisco Prime Collaboration Provisioning Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of...
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied...
Cross site scripting
A cross-site scripting XSS vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation in the file upload interface. A...
Cross site scripting
In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login attempt. The value supplied by this header will be inserted into administrative logs, found at Advanc...
CVE-2020-3113
A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of...
CVE-2020-8824
Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless Access Control Add Managed Device screen...
CVE-2015-0749
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker...
CVE-2015-0749
Cisco Unified Communications Manager is affected by a cross-site scripting (XSS) vulnerability due to improper input validation of certain parameters. An unauthenticated, remote attacker could lure a user to follow a malicious link, potentially allowing the attacker to execute arbitrary script co...