4984 matches found
PT-2020-21477
Name of the Vulnerable Software and Affected Versions @ionic/core versions prior to 4.0.3 @ionic/core versions prior to 4.1.3 @ionic/core versions prior to 4.2.1 @ionic/core versions prior to 4.3.1 Description The issue affects @ionic/core, where the package uses the unsafe innerHTML function...
PT-2020-21514
Name of the Vulnerable Software and Affected Versions jquery.json-viewer versions prior to 1.3.0 Description The issue arises from insufficient sanitization of user input when creating links, allowing attackers to create malicious links with JSON payloads. This can lead to arbitrary JavaScript...
GHSA-3QH4-R86R-GRVM Arbitrary JavaScript Execution in typed-function
Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code. Recommendation Upgrade to version 0.10.6 or later...
GHSA-9PR3-7449-977R Cross-Site Scripting in express-cart
All versions of harp are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages. Recommendation No fix is currently...
Cross-Site Scripting in express-cart
All versions of harp are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages. Recommendation No fix is currently...
PT-2020-21256
Name of the Vulnerable Software and Affected Versions harp versions all Description The issue concerns a Cross-Site Scripting vulnerability due to the misconfiguration of the rendering engine in harp, which fails to sanitize HTML output. This allows attackers to run arbitrary JavaScript when...
PT-2020-21202
Name of the Vulnerable Software and Affected Versions harp versions affected versions not specified Description The issue allows for Cross-Site Scripting, where an attacker can inject arbitrary JavaScript as a new product option in the admin page, enabling the execution of arbitrary code. This...
PT-2020-21129
Name of the Vulnerable Software and Affected Versions ag-grid-community versions prior to 14.0.0 Description The issue arises from improper sanitization of grid contents, which may allow attackers to execute arbitrary JavaScript if user input is rendered in the grid. This can lead to Cross-Site...
Cross-Site Scripting in highcharts
Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link...
PT-2020-21318
Name of the Vulnerable Software and Affected Versions highcharts versions prior to 7.2.2 highcharts versions prior to 8.1.1 Description The issue arises from the failure to sanitize href values and the lack of restriction on URL schemes, allowing attackers to execute arbitrary JavaScript in a...
WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS
Multiple stored cross-site scripting vulnerabilities in WP Customer Reviews 3.4.2 and lower allow remote attackers to inject arbitrary JavaScript code or HTML. PoC If WP Customer Reviews is enabled on a page, an unauthenticated attacker can exploit XSS via review form's parameters: - Reviewer Nam...
Cross-Site Scripting (XSS)
tinymce is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser when the library is configured in classic editing mode. The stripping and sanitization logic of TinyMCE can be bypassed using nested and non-terminated HTML tags,...
Cross-Site Scripting (XSS)
prismjs is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript via the easing preview of the Previewers plugin...
PT-2020-13186
Name of the Vulnerable Software and Affected Versions TinyMCE versions 4.9.10 and earlier TinyMCE versions 5.2.1 and earlier TinyMCE versions 5.4.0 and earlier Description A cross-site scripting XSS vulnerability allows remote attackers to inject arbitrary web script when configured in classic...
CVE-2020-4539
IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
Cross-Site Scripting (XSS)
Jenkins is vulnerable to cross-site scripting. The agent name in the build time trend page is not validated, allowing an attacker to inject and execute arbitrary Javascript in a user's browser...
Cross site scripting
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...
CVE-2020-4542
The CVE-2020-4542 entry describes a cross-site scripting vulnerability in IBM Jazz Foundation and IBM Engineering products, allowing an attacker to embed arbitrary JavaScript in the Web UI and potentially disclose credentials within a trusted session. Affected products/versions include IBM RQM (6...
PT-2020-18047
Name of the Vulnerable Software and Affected Versions IBM Jazz Foundation and IBM Engineering products affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...