CVE-2020-10944

HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fixed in 0.10.5...

PT-2020-12438

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 0.10.4 and earlier Description The issue allows files from a malicious workload to cause arbitrary JavaScript to execute in the web UI, due to a cross-site scripting vulnerability. Recommendations...

PT-2020-15020

Name of the Vulnerable Software and Affected Versions TinyMCE versions 4.9.6 and earlier TinyMCE versions 5.1.3 and earlier Description A cross-site scripting XSS issue was discovered in the core parser, paste and visualchars plugins, allowing arbitrary JavaScript execution when inserting special...

PT-2020-20178

Name of the Vulnerable Software and Affected Versions GistPress plugin versions prior to 3.0.2 Description The issue exists in the shortcode functionality of the plugin via the id parameter in the includes/class-gistpress.php file. This allows an attacker with the WordPress Contributor role to...

Cross-Site Scripting

Overview All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers bei...

Design/Logic Flaw

Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability via an SVG image and HTML file that allows an authenticated user to execute arbitrary JavaScript in an administrator's browser...

CVE-2019-18667

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

CVE-2019-5458

Cross-site scripting XSS vulnerability in http-file-server all versions allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser...

PT-2019-2914

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 76.0.3809.87 Description The issue is related to insufficient filtering in URI schemes, allowing a remote attacker to bypass navigation restrictions. This could potentially enable the execution of arbitrary...

Cross-Site Scripting

Overview Versions of jquery.json-viewer prior to 1.3.0 are vulnerable to Cross-Site Scripting XSS. The package insufficiently sanitizes user input when creating links, and concatenates the user input in an tag. This allows attackers to create malicious links with JSON payloads such as: "foo":...

PT-2019-2815

Name of the Vulnerable Software and Affected Versions Palo Alto Networks MineMeld versions 0.9.60 and earlier Description The issue exists due to insufficient protection of the web page structure. It may allow a remote attacker to execute arbitrary JavaScript code in the admin's browser if they c...

PT-2019-20038

Name of the Vulnerable Software and Affected Versions ids-enterprise versions prior to 4.18.2 Description The issue affects the soho-autocomplete component where script tags are not properly encoded, potentially allowing attackers to execute arbitrary JavaScript through Cross-Site Scripting XSS...

CVE-2019-9673

Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI...

CVE-2019-9673

Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI...

CVE-2019-9673

Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI...

CVE-2019-9673: Undefined Security Weakness

Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI...

PT-2019-2503

Name of the Vulnerable Software and Affected Versions БАРС.ЖКХ-Жилищный Фонд affected versions not specified Description The issue is related to insufficient protection of the web page structure in the БАРС.ЖКХ-Жилищный Фонд platform. An attacker can exploit this issue by using a specially crafte...

CVE-2019-10905

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

PT-2019-12083

Name of the Vulnerable Software and Affected Versions Parsedown versions prior to 1.7.2 Description The issue allows attackers to execute arbitrary JavaScript code if a script, already running on the affected page, executes the contents of any element with a specific class. This occurs because...

CVE-2019-10646

Wolf CMS v0.8.3.1 is affected by cross site scripting XSS in the module Add Snippet /?/admin/snippet/add. This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded...