PT-2021-11062

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho versions 7.x through 8.x Description: The Dashboard Editor in Hitachi Vantara Pentaho contains a reflected Cross-site scripting issue, allowing authenticated remote users to execute arbitrary JavaScript code. The...

PT-2021-11061

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho versions 7.x through 8.x Description: The issue is a DOM-based Cross-site scripting vulnerability that allows authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the...

CVE-2020-4855

IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190457...

Cross-Site Scripting (XSS)

@scullyio/scully is vulnerable to cross-site scripting XSS. The transfer-state is serialized using JSON.stringify function and subsequently written into the HTML page without sanitization, allowing an attacker to inject arbitrary Javascript code in a user's browser...

Code injection

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine...

CVE-2020-28464 Remote Code Execution (RCE)

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine...

CVE-2020-28464

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine...

CVE-2020-28464: Improper Control of Generation of Code

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine...

PT-2021-11535

Name of the Vulnerable Software and Affected Versions: djv versions prior to 2.1.4 Description: The issue allows an attacker to run arbitrary JavaScript code on the victim machine by controlling the schema file. Recommendations: For versions prior to 2.1.4, update to version 2.1.4 or later to...

CVE-2020-26280 XSS in OpenSlides

OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting XSS. In the web applicatio...

The vulnerability of Adobe Experience Manager’s content and media management system lies in its lack of protection for website structures. This allows attackers to execute arbitrary JavaScript code in the user’s browser.

The vulnerability of the Adobe Experience Manager content and media management system is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser using a specially crafted website...

Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site Scripting

Stored Cross-Site Scripting vulnerabilities in Themify Portfolio Post = 1.1.5 allow low-privileged users Contributor+ to inject arbitrary Javascript code or HTML in posts where the Themify Custom Panel is embedded. PoC 1. As a contributor, go into "Portfolios" tab from the sidebar and create a ne...

Cross site scripting

Stored Cross-site scripting XSS vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'...

CVE-2020-9860: Undefined Security Weakness

A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in Safari 13.0.5. Processing a maliciously crafted URL may lead to arbitrary javascript code execution...

PT-2020-4595

Name of the Vulnerable Software and Affected Versions Marketo Sales Insight plugin version 1.4355 and earlier Description The issue is related to a blind stored Cross-Site Scripting XSS vulnerability. This could allow an attacker to inject malicious scripts into vulnerable form fields. When a...

Design/Logic Flaw

An issue was discovered in Sage DPW 202006x before 202006002. The search field "Kurs suchen" on the page Kurskatalog is vulnerable to Reflected XSS. If the attacker can lure a user into clicking a crafted link, he can execute arbitrary JavaScript code in the user's browser. The vulnerability can ...

Cross site scripting

A stored cross-site scripting XSS vulnerability exists in the SonicOS SSLVPN web interface. A remote unauthenticated attacker is able to store and potentially execute arbitrary JavaScript code in the firewall SSLVPN portal. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen ...

PT-2020-18281

Name of the Vulnerable Software and Affected Versions SonicOS Gen 5 versions 5.9.1.7 through 5.9.1.13 SonicOS Gen 6 versions 6.0.5.3 through 6.5.4.7 SonicOSv version 6.5.4.v SonicOS Gen 7 version 7.0.0.0 Description A stored cross-site scripting XSS issue exists in the SonicOS SSLVPN web interfac...

Cross site scripting

Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a...

PT-2020-10875

Name of the Vulnerable Software and Affected Versions Handlebars versions prior to 3.0.8 Handlebars versions 4.x prior to 4.5.3 Description The issue allows attackers to execute arbitrary JavaScript code by submitting templates that are not properly validated by the lookup helper. This can lead t...