PT-2021-2957

Name of the Vulnerable Software and Affected Versions Adobe Coldfusion versions 2016 update 16 and earlier Adobe Coldfusion versions 2018 update 10 and earlier Adobe Coldfusion version 2021.0.0.323925 Description The issue is related to improper neutralization of input during web page generation,...

CVE-2021-28968: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the email BBcode tag allows with authentication injecting arbitrary JavaScript into any forum message...

MyBB 未授权RCE漏洞（CVE-2021-27889 CVE-2021-27890）

MyBB Remote Code Execution Chain BY SIMON SCANNELL & CARL SMITH Today SonarSource is pleased to share with you a guest contribution to our Code Security blog series. The following blog post is authored by Simon Scannell and Carl Smith -two independent security researchers- joining us in sharing...

CVE-2021-24136

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

Cross site scripting

Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting XSS vulnerabilities allowing low-privileged users Contributor+ to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Pan...

Cross site scripting

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

CVE-2021-24136 Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

Cross-Site Scripting (XSS)

keycloak-theme is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the referrer URL in the new account console...

Code injection

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...

Eclipse Theia 跨站脚本漏洞

Eclipse Theia is the Eclipse Foundation's set of Visual Studio Code-based open source integrated development environment for desktop and Web applications framework. A cross-site scripting vulnerability exists in Eclipse Theia 1.8.0 and prior versions, which stems from the absence of HTML escaping...

CVE-2020-13959

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to...

Adobe Creative Cloud Desktop Application 跨站脚本漏洞

Adobe Connect is an online video conferencing software. A reflected cross-site scripting vulnerability exists in Adobe Connect 11.0.5 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary JavaScript in a browser...

Adobe Connect Cross-Site Scripting Vulnerability (CNVD-2021-18028)

Adobe Connect is an online video conferencing software. A reflected cross-site scripting vulnerability exists in Adobe Connect 11.0.5 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary JavaScript in a browser...

PT-2021-2955

Name of the Vulnerable Software and Affected Versions Adobe Connect affected versions not specified Description The issue is related to the lack of protection of the web page structure in Adobe Connect, allowing a remote attacker to execute arbitrary JavaScript code in the user's browser...

CVE-2020-29029

Improper Input Validation, Cross-site Scripting XSS vulnerability in Web GUI of Secomea GateManager allows an attacker to execute arbitrary javascript code. This issue affects: Secomea GateManager all versions prior to 9.4...

CVE-2020-29028 Reflected XSS issues

Cross-site Scripting XSS vulnerability in web GUI of Secomea GateManager allows an attacker to inject arbitrary javascript code. This issue affects: Secomea GateManager all versions prior to 9.4...

PT-2021-11636

Name of the Vulnerable Software and Affected Versions: Secomea GateManager versions prior to 9.4 Description: The issue is related to Improper Input Validation and a Cross-site Scripting XSS vulnerability in the Web GUI of Secomea GateManager. This allows an attacker to execute arbitrary javascri...

CVE-2020-29029: Improper Input Validation

Improper Input Validation, Cross-site Scripting XSS vulnerability in Web GUI of Secomea GateManager allows an attacker to execute arbitrary javascript code. This issue affects: Secomea GateManager all versions prior to 9.4...

CVE-2020-29028: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS vulnerability in web GUI of Secomea GateManager allows an attacker to inject arbitrary javascript code. This issue affects: Secomea GateManager all versions prior to 9.4...

Cross site scripting

IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192435...