The vulnerability of the web interface of the microprogramming software for Pelco cameras, models Sarix Enhanced and Spectra Enhanced, allows a intruder to execute any JavaScript code in the user’s browser.

The vulnerability of the web interfaces of Pelco Sarix Enhanced and Spectra Enhanced microprogramming systems lies in the insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser...

Cross site scripting

An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete t...

CVE-2018-13309

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...

PT-2018-11731

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to execute arbitrary JavaScript by modifying the User phrases button field in notice gen.htm, potentially leading to cross-site scripting. Recommendations For TOTOLINK A3002...

PT-2018-11736

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to execute arbitrary JavaScript by modifying the Input your notice URL field in notice gen.htm, potentially leading to cross-site scripting. Recommendations For TOTOLINK...

CVE-2018-16474

CVE-2018-16474 concerns the Node.js module tianma-static . Concrete details show that all versions up to 1.0.4 are vulnerable to a stored XSS if an attacker can control the name of a file served by the module. Affected condition: filenames unsanitized, enabling arbitrary JavaScript execution when...

PT-2018-16168

Name of the Vulnerable Software and Affected Versions public versions prior to 0.1.4 public versions = 1.0.3 Description The issue allows embedding HTML in file names, which under certain conditions might lead to the execution of malicious JavaScript. This is due to the failure to sanitize...

Cross site scripting

The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting XSS attacks. In this form of attack,...

PT-2018-9452

Name of the Vulnerable Software and Affected Versions OCS Inventory NG version ocsreports 2.4 Description The issue concerns a Cross Site Scripting XSS vulnerability in the login form and search functionality. This allows an attacker to execute arbitrary JavaScript code within a victim's browser...

CVE-2013-7202: Undefined Security Weakness

The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system...

pym.js CSRF Vulnerability

NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross Site Request Forgery CSRF vulnerability in Pym.js onNavigateToMessage function. https://github.com/nprapps/pym.js/blob/master/src/pym.jsL573 can result in Arbitrary javascript code execution. This attack appears to be...

CVE-2018-1000086

NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery CSRF vulnerability in Pym.js onNavigateToMessage function. https://github.com/nprapps/pym.js/blob/master/src/pym.jsL573 that can result in Arbitrary javascript code execution. This attack appear to be...

CVE-2017-18121

The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser...

Cross site scripting

An exploitable cross site scripting XSS vulnerability exists in the add filter functionality of the railsadmin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish ...

CVE-2014-0073: Undefined Security Weakness

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin org.apache.cordova.inappbrowser before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute...

PT-2017-3711

Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.4.0 through 5.4.5 FortiOS version 5.6.0 Description: A Cross-Site-Scripting XSS vulnerability exists in the webUI "Login Disclaimer" redir parameter, allowing a remote unauthenticated attacker to execute arbitrary javascrip...

PT-2017-7293

Name of the Vulnerable Software and Affected Versions Samsung Galaxy S6 SecEmailUI affected versions not specified Description The issue allows remote attackers to execute arbitrary JavaScript due to the lack of HTML email content sanitization. Recommendations At the moment, there is no informati...

PT-2016-3425

Name of the Vulnerable Software and Affected Versions Yandex browser for desktop versions prior to 16.6 Description The issue is related to a lack of protection for the web page structure in the BookReader extension of Yandex Browser, which could allow a remote attacker to conduct a cross-site...

CVE-2015-0821: Undefined Security Weakness

Mozilla Firefox before 36.0 allows user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions...

Ubuntu 12.04 LTS : kde-runtime vulnerability (USN-2414-1)

Tim Brown and Darron Burton discovered that KDE-Runtime incorrectly handled input validation. An attacker could possibly use this issue to execute arbitrary javascript. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory...