CVE-2020-9381

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954...

Design/Logic Flaw

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954...

CVE-2020-9381

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954...

CVE-2020-9381: Incorrect Authorization

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954...

PT-2020-20623

Name of the Vulnerable Software and Affected Versions Total.js CMS version 13 Description The issue allows remote attackers to execute arbitrary code via a POST to the "/admin/api/widgets/" API endpoint. Recommendations For Total.js CMS version 13, consider restricting access to the...

Cross site scripting

IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158113...

CVE-2019-4115

IBM WebSphere eXtreme Scale Admin API (v8.6) is affected by cross-site scripting in the Admin UI, enabling injection of arbitrary JavaScript and potential credential disclosure within a trusted session. Root cause: inadequate input sanitization in the Admin UI. Impact is described in multiple sou...

PT-2019-16904 · Ibm · Ibm Websphere Extreme Scale

Name of the Vulnerable Software and Affected Versions: IBM WebSphere eXtreme Scale version 8.6 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session. This...

CVE-2019-4115: Improper Neutralization of Input During Web Page Generation

IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158113...

CVE-2018-12409

The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions up to and including 5.8.1...

CVE-2018-12409

The CVE-2018-12409 issue affects TIBCO Silver Fabric, specifically the SOAP Admin API component. The vulnerability is a reflected cross-site scripting (XSS) flaw in the SOAP Admin API, with affected releases up to and including 5.8.1. Reports from TIBCO’s advisory indicate the impact could enable...

CVE-2018-12409

The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions up to and including 5.8.1...

Cross site scripting

The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions up to and including 5.8.1...

PT-2019-8894

Name of the Vulnerable Software and Affected Versions TIBCO Silver Fabric versions up to and including 5.8.1 Description The issue concerns a reflected cross-site scripting XSS attack in the SOAP Admin API component. This type of attack occurs when an application takes user input and sends it bac...

CVE-2018-12409: Improper Neutralization of Input During Web Page Generation

The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions up to and including 5.8.1...

TIBCO Security Advisory: February 13, 2019 - TIBCO SilverFabric

TIBCO Silver Fabric Vulnerable to Reflected Cross-Site Scripting attacks Original release date: February 13,2019 Last revised: CVE-2018-12409 Source: TIBCO Software Inc. TIBCO Silver Fabric Vulnerable to Reflected Cross-Site Scripting attacks Original release date: February 13, 2019 Last revised:...

TIBCO Security Advisory: February 13, 2019 - TIBCO SilverFabric

TIBCO Silver Fabric Vulnerable to Reflected Cross-Site Scripting attacks Original release date: February 13,2019 Last revised: CVE-2018-12409 Source: TIBCO Software Inc. TIBCO Silver Fabric Vulnerable to Reflected Cross-Site Scripting attacks Original release date: February 13, 2019 Last revised:...

PT-2018-14385

Name of the Vulnerable Software and Affected Versions LUYA CMS version 1.0.12 Description A Stored XSS issue has been found in the software. The issue can be exploited via the "/admin/api-cms-nav/create-page" API endpoint. Recommendations For version 1.0.12, consider disabling access to the...

CVE-2018-18259: Improper Neutralization of Input During Web Page Generation

Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page...

Authentication Bypass

github.com/minio/minio is vulnerable to authentication bypass attacks. The vulnerability exists as attackers can modify pre-signed signature V2 requests to make Admin-API calls...