2137 matches found
CVE-2020-15774
An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reopen their browser to access Gradle Enterprise as that user...
CVE-2020-8339
A cross-site scripting inclusion XSSI vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module AMM web interface prior to version 3.68n BPET68N. This vulnerability could allow an authenticated user's AMM credentials to be disclosed if the user is convinced to visit a...
Cross-Site Scripting (XSS)
webkit2gtk3 is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript on the user's browser by providing malicious web content...
Cross-Site Scripting (XSS)
webkit2gtk3 is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript on the user's browser by providing malicious web content...
Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr
Description This package is vulnerable to Cross-site Scripting XSS. The module renders user controllable value in the browser. In "card-rec.php" file, user controllable value coming from "$POST"titre" is directly appended to input field which will reflect back user provided string. An Attacker ca...
Cross-Site Scripting in nextcloud-vue-collections
Versions of nextcloud-vue-collections prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code i...
Cross-Site Scripting in @berslucas/liljs
Versions of @berslucas/liljs prior to 1.0.2 are vulnerable to Cross-Site Scripting XSS. The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. Recommendation Upgrade to version 1.0.2 or later...
GHSA-C53X-WWX2-PG96 Cross-Site Scripting in @berslucas/liljs
Versions of @berslucas/liljs prior to 1.0.2 are vulnerable to Cross-Site Scripting XSS. The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. Recommendation Upgrade to version 1.0.2 or later...
Malicious Package
oauth-validator is a malicious package. The package contains code that when executed in the browser, would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...
greasemonkeycolumbia227.com Cross Site Scripting vulnerability OBB-1286595
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-16266
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on viewallbugpage.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue if CSP...
Microsoft Office SharePoint XSS Vulnerability
A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...
Ubuntu 18.04 LTS / 20.04 LTS : WebKitGTK vulnerabilities (USN-4444-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4444-1 advisory. A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a maliciou...
Design/Logic Flaw
OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution of malicious code within the user’s browser...
Cross-Site Scripting (XSS)
jspdf is vulnerable to cross-site scripting. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the HTML method...
CVE-2020-15085
This CVE affects Saleor Storefront prior to version 2.10.3. Authentication-related data could be cached in the browser’s local storage, enabling an attacker with local access to extract email addresses and passwords. Prior to 2.10.0, the cached data could persist after logout; the issue is fixed ...
CVE-2016-11081
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser...
Microsoft Edge Spoofing Vulnerability (CNVD-2020-61591)
Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A security vulnerability exists in Microsoft Edge based on Chromium IE mode, which arises from the program not handling specific redirects correctly. The vulnerability can be exploited by...
Cross-site Scripting (XSS)
verbb/comments is vulnerable to cross-site scripting XSS. It is possible because it does not sanitize the user-provided input for guest name username, allowing an attacker to inject and execute malicious scripts in a user's browser...
U.S. Dept Of Defense: XSS via X-Forwarded-Host header
Summary: The █████ website is vulnerable to a cross-site scripting flaw if the server receives a crafted X-Forwarded-Host header. Description: The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a...