PT-2020-5124

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.5.0 and below Adobe Experience Manager versions 6.4.8.1 and below Adobe Experience Manager versions 6.3.3.8 and below Adobe Experience Manager versions 6.2 SP1-CFP20 and below Description The issue is...

GHSA-5FF8-JCF9-FW62 Cross-Site Scripting in markdown-it-katex

All versions of markdown-it-katex are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error. Recommendation No fix is currently available. Consider using a...

Cross-Site Scripting in atlasboard-atlassian-package

All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers being able t...

Cross-Site Scripting in nextcloud-vue-collections

Versions of nextcloud-vue-collections prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code i...

PT-2020-21559

Name of the Vulnerable Software and Affected Versions nextcloud-vue-collections versions prior to 0.4.2 Description The issue concerns an insecure configuration in the v-tooltip component, which allows arbitrary JavaScript to be injected into the tooltip of a collection item. This enables attacke...

PT-2020-20949

Name of the Vulnerable Software and Affected Versions atlasboard-atlassian-package versions prior to 0.4.2 Description The issue arises from the package's failure to properly sanitize user input that is rendered as HTML, potentially allowing attackers to execute arbitrary JavaScript in a victim's...

GHSA-VPJ4-89Q8-RH38 Cross-Site Scripting in bpmn-js-properties-panel

Versions of bpmn-js-properties-panel prior to 0.31.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. Recommendation Upgrade to version 0.31.0 or lat...

GHSA-V9WP-8R97-V6XG Cross-Site Scripting in jquery.json-viewer

Versions of jquery.json-viewer prior to 1.3.0 are vulnerable to Cross-Site Scripting XSS. The package insufficiently sanitizes user input when creating links, and concatenates the user input in an tag. This allows attackers to create malicious links with JSON payloads such as: "foo":...

GHSA-C53X-WWX2-PG96 Cross-Site Scripting in @berslucas/liljs

Versions of @berslucas/liljs prior to 1.0.2 are vulnerable to Cross-Site Scripting XSS. The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. Recommendation Upgrade to version 1.0.2 or later...

CVE-2020-12058

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

Cross site scripting

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

CVE-2020-12058

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

PT-2020-21409

Name of the Vulnerable Software and Affected Versions dompurify versions prior to 2.0.7 Description The issue allows an attacker to bypass the package sanitization through Mutation XSS, potentially enabling the execution of arbitrary JavaScript in a victim's browser. Recommendations Upgrade to...

PT-2020-21348

Name of the Vulnerable Software and Affected Versions snekserve versions all Description The issue arises from the failure to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. This is a Cross-Site...

PT-2020-21047

Name of the Vulnerable Software and Affected Versions bleach versions affected versions not specified Description The issue allows attackers to bypass the package's HTML sanitization, potentially leading to Cross-Site Scripting XSS attacks. This can be achieved with specific payloads, such as...

PT-2020-21476

Name of the Vulnerable Software and Affected Versions eco versions all Description The issue concerns Cross-Site Scripting XSS due to the package's default escape implementation failing to properly escape single quotes. This failure may allow attackers to execute arbitrary JavaScript on the...

PT-2020-21528

Name of the Vulnerable Software and Affected Versions bpmn-js-properties-panel versions prior to 0.31.0 Description The issue is related to Cross-Site Scripting XSS due to the failure to sanitize input in specially configured diagrams. This may allow attackers to inject arbitrary JavaScript in th...

PT-2020-21024

Name of the Vulnerable Software and Affected Versions takeapeek versions all versions Description The issue concerns a failure to sanitize filenames, which allows attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. This is a...

PT-2020-13020

Name of the Vulnerable Software and Affected Versions osCommerce CE Phoenix versions prior to 1.0.6.0 Description The issue allows an attacker to inject and execute arbitrary JavaScript code. This can be achieved by injecting malicious code into specific parameters, including the page parameter t...

PT-2020-21246

Name of the Vulnerable Software and Affected Versions @toast-ui/editor versions prior to 2.2.0 Description The issue allows attackers to execute arbitrary JavaScript on a victim's browser due to multiple bypasses of the package's built-in XSS sanitization, which may lead to Cross-Site Scripting...