Shopify: H1514 Stored XSS in Return Magic App portal content

Summary: Stored XSS vulnerability was found in return magic app portal content which executes in the application domain in https://services.alveo.io/dashboard-shopify/settings/portal/content Description: It's been found that Return Magic app allows users to add HTML content to their return portal...

CVE-2018-1691

IBM Rational Quality Manager RQM 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

PT-2018-13095

Name of the Vulnerable Software and Affected Versions IBM Rational Quality Manager RQM versions 5.0 through 5.02 IBM Rational Quality Manager RQM versions 6.0 through 6.0.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and...

PT-2018-13781

Name of the Vulnerable Software and Affected Versions IBM Rational Quality Manager RQM versions 5.0 through 5.02 IBM Rational Quality Manager RQM versions 6.0 through 6.0.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and...

PT-2018-12286

Name of the Vulnerable Software and Affected Versions IBM Rational Quality Manager RQM versions 5.0 through 5.02 IBM Rational Quality Manager RQM versions 6.0 through 6.0.6 Description This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality an...

PT-2018-13388

Name of the Vulnerable Software and Affected Versions IBM Rational Quality Manager RQM versions 5.0 through 5.02 IBM Rational Quality Manager RQM versions 6.0 through 6.0.6 Description This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality an...

PT-2018-12255

Name of the Vulnerable Software and Affected Versions IBM Rational Quality Manager RQM versions 5.0 through 5.02 IBM Rational Quality Manager RQM versions 6.0 through 6.0.6 Description This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality an...

CVE-2018-9079

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model DOM of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the...

CVE-2018-9079: Improper Neutralization of Input During Web Page Generation

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model DOM of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the...

PT-2018-18839

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The Content Explorer application in the affected devices allows users to upload files to shares, including SVG images, without proper restrictions. These imag...

PT-2018-18840

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The issue allows adversaries to craft URLs that can modify the Document Object Model DOM of a page. Additionally, they can inject HTML script tags and HTML ta...

CVE-2018-1716

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 1471...

CVE-2018-1660

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 1448...

CVE-2018-1820

IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150096...

PT-2018-1946

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 7.0 through 9.0 Description The issue exists due to insufficient protection of the web page structure, allowing a remote attacker to embed arbitrary JavaScript code in the web interface, potentially leading to...

CVE-2018-1560

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2018-10497

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...

CVE-2018-10499: Improper Input Validation

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4.0.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw...

BTITeam XBTIT cross-site scripting vulnerability (CNVD-2019-28274)

XBTIT is an open source tracking software. A reflective cross-site scripting vulnerability exists in the 'keywords' parameter in the search function in /index.php?page=forums&action=search in BTITeam XBTIT 2.5.4. The vulnerability can be exploited to execute arbitrary JavaScript code in a user's...

Cross-site Scripting (XSS)

github.com/portainer/portainer is vulnerable to cross-site scripting XSS attacks. The library does not use HTTP Secure Headers, allowing a malicious user to inject and execute arbitrary Javascript through the Team Name field...