Atlassian JIRA < 7.13.6 / 8.x < 8.4.0 XSS (JRASERVER-69795)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.13.6, or 8.x prior to 8.4.0. It is, therefore, affected by a cross-site scripting XSS vulnerability. The vulnerability exists in the Optimization plugin due to improper...

Atlassian JIRA < 7.13.9 / 8.x < 8.3.3 XSS (JRASERVER-69790)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.13.9, or 8.x prior to 8.3.3 / 8.4.0. It is, therefore, affected by a cross-site scripting XSS vulnerability. The vulnerability exists in the FilterPickerPopup.jspa resource...

HomeAutomation 3.3.2 - Persistent Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit: HomeAutomation 3.3.2 - Persistent Cross-Site Scripting Author: LiquidWorm Vendor: Tom Rosenback and Daniel Malmgren Product web page: http://karpero.mine.nu/ha/ Affected version: 3.3.2 Tested on: Apache/2.4.41 centos...

Security Advisory 2019-11-05-2 - LuCI CSRF vulnerability (CVE-2019-17367)

DESCRIPTION A logic flaw in LuCI's HTTP routing component led to ineffective CSRF token testing for various request endpoints, specifically ones using the arcombine dispatch action. This allows 3rd party web pages running in the same browser session as an active LuCI login session to perform...

Cisco Unity Connection Web Framework XSS (cisco-sa-20191002-cuc-xss)

A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session...

Cisco TelePresence VCS / Expressway 12.5.x < 12.5.4 XSS

According to its self-reported version, the Cisco TelePresence Video Communication Server VCS / Expressway running on the remote host is 12.5.x prior to 12.5.4. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input before returnin...

Jenkins < 2.176.4 LTS / 2.197 Multiple Vulnerabilities

The version of Jenkins running on the remote web server is prior to 2.197 or is a version of Jenkins LTS prior to 2.176.4. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists in the /whoAmI/ URL due to the exposed 'Cookie' HTTP Header. An...

Puppet Enterprise 2017.x < 2017.3.6 Cross-site Scripting Vulnerability

According to its self-reported version number, the Puppet install running on the remote host is version 4.x prior to 2016.2.1, 5.3.x prior to 2017.3.7, or 5.5.x prior to 2018.1.1. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied...

V-SOL GPON/EPON OLT Platform 2.03 Cross Site Scripting

V-SOL GPON/EPON OLT Platform v2.03 Reflected XSS Vulnerability Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd. Product web page: https://www.vsolcn.com Affected version: V2.03.62RIPv6 V2.03.54R V2.03.52R V2.03.49 V2.03.47 V2.03.40 V2.03.26 V2.03.24 V1.8.6 V1.4 Summary: GPON is...

Atlassian JIRA 7.7.x < 7.13.1 XSS vulnerability (JRASERVER-69238)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.13.1. It is therefore, potentially affected by a cross-site scripting XSS vulnerability in the cyclePeriod parameter due to improper validation of user-supplied input data. ...

IBM WebSphere Portal XSS Vulnerability (CVE-2018-1673)

The version of IBM WebSphere Portal installed on the remote Windows host is affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a...

Ping Identity: Session misconfiguration on change password feature at https://apps-staging.pingone.com/myaccount/?environmentId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx#

Summary: After loooking into session related issue , i can see that there is session misconfiguration on change password feature at https://apps-staging.pingone.com Steps To Reproduce: 1 go to https://apps-staging.pingone.com/myaccount/?environmentId=XXXXX and login as user-A in browser-A 2 go to...

Tenable Nessus <= 8.4.0 Multiple XSS Vulnerabilities (TNS-2019-04)

Tenable Nessus is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

[R2] Nessus 8.5.0 Fixes Multiple Vulnerabilities

Nessus versions 8.4.0 and earlier were found to contain multiple XSS vulnerabilities due to improper validation of user-supplied input. For CVE-2019-3961, an unauthenticated, remote attacker could exploit this vulnerability via a specially crafted request to execute arbitrary script code in a...

CVE-2019-4152

IBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely manner. The lack of proper session expiration may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 158515...

CVE-2019-4152

CVE-2019-4152 affects IBM Security Access Manager (ISAM) software, specifically ISAM 9.0.1 through 9.0.6 (and ISAM Appliance 9.0.1–9.0.6). The root cause is improper invalidation/expiration of session tokens, leading to potential login into a closed browser session by an attacker with local acces...

CVE-2019-3790

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was...

CVE-2019-3790 Ops Manager uaa client issues tokens after refresh token expiration

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was...

CVE-2019-7671

Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site...

PT-2019-18694 · Prima Systems · Flexair

Name of the Vulnerable Software and Affected Versions: Prima Systems FlexAir versions 2.3.38 and prior Description: The issue arises from parameters sent to scripts not being properly sanitized before being returned to the user. This may allow an attacker to execute arbitrary code in a user’s...