PT-2020-6118

Name of the Vulnerable Software and Affected Versions Bitrix24 affected versions not specified Description The issue exists due to insufficient input validation of the arParamsAPI KEY parameter in the map.google component of the Bitrix24 business management service. This could allow a remote...

PT-2020-20178

Name of the Vulnerable Software and Affected Versions GistPress plugin versions prior to 3.0.2 Description The issue exists in the shortcode functionality of the plugin via the id parameter in the includes/class-gistpress.php file. This allows an attacker with the WordPress Contributor role to...

Cross-Site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the HTML comments and CDATA information...

Remote Code Execution

angular-expressions is vulnerable to remote code execution. An attacker to execute arbitrary Javascript expressions on the system when the function compile is called with user-controlled input...

Cross-Site Scripting

Overview Versions of @hapi/boom prior t 0.3.8 are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 0.3.8 or later. References - Snyk repor...

Cross-Site Scripting

Overview Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later. References - HackerOne...

Cross-Site Scripting (XSS)

apacheairflow is vulnerable to cross-site scripting XSS. An administrative user is able to inject and execute arbitrary Javascript into a user's browser by modifying the state of an object when the application is running with the classic UI...

Code injection

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

PYSEC-2020-162

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

CVE-2019-0219

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI...

CVE-2019-0219

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI...

EUVD-2020-0969

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI...

CVE-2019-0219: Undefined Security Weakness

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI...

PT-2020-22667

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 1.10.5 Description A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views when running with the "classic" UI. The new "RBAC...

PT-2020-9308

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 1.10.5 Description A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views when running with the classic UI. The new RBAC UI...

Cross site scripting

Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folderup.png IMG element not properly sanitizing user-inserted directory...

CVE-2020-5195

Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folderup.png IMG element not properly sanitizing user-inserted directory...

Cross-Site Scripting (XSS)

node-red is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the name field when renaming a flow in the Workspace dialog...

Cross-Site Scripting (XSS)

github.com/tophubs/toplist is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the title...

Cross-Site Scripting

Overview All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers bei...