985 matches found
CVE-2021-25917
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly and rendered in the U2F USB Device authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...
CVE-2021-25918
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...
CVE-2021-25919
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...
PT-2021-16847
Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.2 through 6.0.0 Description The issue is related to Stored Cross-Site-Scripting XSS due to improper validation of user input, which is then rendered in the U2F USB Device authentication method page. A highly privileged...
PT-2021-16848
Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.2 through 6.0.0 Description The issue is related to Stored Cross-Site-Scripting XSS due to improper validation of user input, which is then rendered in the TOTP Authentication method page. A highly privileged attacker coul...
PT-2021-16849
Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.2 through 6.0.0 Description The issue is related to Stored Cross-Site-Scripting XSS due to improper validation of user input. A highly privileged attacker could inject arbitrary code into input fields when creating a new...
Integer overflow
An integer overflow flaw was found in libtiff that exists in the tifgetimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...
CVE-2020-28502
An arbitrary code injection vulnerability was found in nodejs-xmlhttprequest. For this vulnerability to occur, the connection must be initialized during the function call XMLHttpRequest.open to send requests synchronously using the parameter async=False. If the subsequent calls to xhr.send...
CVE-2020-28502
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...
CVE-2020-28502
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...
CVE-2020-28502
The CVE-2020-28502 issue affects the Node.js packages xmlhttprequest (pre-1.7.0) and xmlhttprequest-ssl (any version). Root cause: inputs sent via xhr.send when requests are synchronous (async=false) can be manipulated to inject and execute arbitrary code, due to how data flows into xhr.send. Pub...
CVE-2020-28502
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...
Arbitrary Code Injection
Overview xmlhttprequest is a wrapper for the built-in http client to emulate the browser XMLHttpRequest object. Affected versions of this package are vulnerable to Arbitrary Code Injection. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.sen...
PT-2021-11557
Name of the Vulnerable Software and Affected Versions: xmlhttprequest versions prior to 1.7.0 xmlhttprequest-ssl all versions Description: The issue arises when requests are sent synchronously, with async=False on xhr.open. If malicious user input flows into xhr.send, it could result in arbitrary...
PT-2021-7457
Name of the Vulnerable Software and Affected Versions underscore versions 1.3.2 through 1.12.1 underscore versions 1.13.0-0 through 1.13.0-2 Description The issue is related to the template function in the underscore library, which is used for working with arrays in JavaScript. It is caused by...
Cross site scripting
Stored cross-site scripting XSS in form field in robust.systems product Custom Global Variables v 1.0.5 allows a remote attacker to inject arbitrary code via the vars0name field...
Cross site scripting
Reflected cross-site scripting vulnerability XSS in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers to inject arbitrary webscript or HTML code via the tab3 parameter...
BDTASK Multi-Store Inventory Management System Cross-Site Scripting Vulnerability
BDTASK Multi-Store Inventory Management System is a multi-store inventory management system from BDTASK Bangladesh. A security vulnerability exists in BDTASK Multi-Store Inventory Management System version 1.0, which originates from a customer name field that fails to properly filter special...
CVE-2021-20357
CVE-2021-20357 affects IBM Jazz Foundation products with a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript and, in a trusted session, potentially disclose credentials. Connected sources corroborate a Web UI XSS across multiple IBM Jazz/F...