Grav 跨站脚本漏洞

A cross-site scripting vulnerability exists in versions of Grav prior to 1.7.28, which stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit the vulnerability to execute JavaScript code on the client side...

IBM i 跨站脚本漏洞

IBM i is a set of operating systems from IBM in the United States that run on IBM Power Systems and IBM PureSystems. A cross-site scripting vulnerability exists in IBM i. The vulnerability stems from the product not validating user-supplied data. An attacker could exploit the vulnerability to...

WordPress Gwolle Guestbook Plugin Cross-Site Scripting Vulnerability (CNVD-2021-103362)

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers.The WordPress Gwolle Guestbook plugin has a cross-site scripting vulnerability in versions prior to 4.2.0, which stems from...

IBM OPENBMC OP910 跨站脚本漏洞

IBM OPENBMC is a POWER8 and POWER9 emulator from International Business Machines Corporation Ibm. IBM OPENBMC has a cross-site scripting vulnerability in version OP910 that stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit the vulnerability...

Delta Electronics DIAEnergie 跨站脚本漏洞

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.A cross-site...

Crafter CMS 跨站脚本漏洞

Crafter CMS is an open source content management system CMS for digital experience applications.A cross-site scripting vulnerability exists in Crafter CMS, which stems from a lack of data validation filtering of user-supplied data and output. An attacker with a Site role could exploit the...

Hexo 跨站脚本漏洞

Hexo is a fast, simple and powerful blogging framework from the personal developer Tommy Chen in China. Hexo suffers from a cross-site scripting vulnerability that stems from Hexo's lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. WordPress Tutor LMS plugin in versions prior to 1.9.9 has a cross-site scripting vulnerability, which stems from the plugin's...

PeerTube 跨站脚本漏洞

PeerTube is a decentralized video sharing service platform. Peertube has a cross-site scripting vulnerability in versions prior to v3.4.0, which stems from the application's lack of user input data validation and filtering of the data at the input location, and could be used by an attacker to...

Deskpro Cross-Site Scripting Vulnerability

Deskpro is a suite of helpdesk software from Deskpro UK. The software includes a customer relationship management component, among other things, and offers features such as e-mail, live chat, and voice. A cross-site scripting vulnerability exists in Deskpro cloud and on-premise Deskpro in version...

CVE-2021-34563

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript...

Design/Logic Flaw

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript...

CVE-2021-34563 In WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify it

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript...

@amitport/useful (>=0.5.0, <=0.5.2), @arivazhagan/demo-project (1.0.1) +966 more potentially affected by CVE-2019-10768 via angular (>=1.0.8, <=1.7.8)

angular NPM version =1.0.8, =0.5.0, =0.0.8, =2.3.0, =1.5.8, =2.8.3-2, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.2.24, =0.0.1, =0.0.1, =0.0.5, =0.1.7 and more Source cves: CVE-2019-10768 Source advisory: OSV:GHSA-89MQ-4X47-5V83...

CVE-2019-17207

A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker aka Broken Link Checker plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the...

Cross site scripting

A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker aka Broken Link Checker plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the...

CVE-2019-17207

The CVE concerns the WordPress Broken Link Checker plugin (version 1.11.8) where the vulnerability resides in includes/admin/table-printer.php. A reflected cross-site scripting (XSS) flaw is triggered via the s_filter parameter in the admin tools page (wp-admin/tools.php?page=view-broken-links), ...

CVE-2018-16590

FURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication...

Microsoft Word Document Upload to Stored XSS: A Case Study

Anytime I see a file upload form during an application test, my attention is piqued. In a best-case scenario, I can upload a reverse shell in a scripting language available on the webserver. If the application is running in PHP or ASP for example, it becomes quite easy. If I cant get a backdoor...

The vulnerability of the UpdateThemeVersionPortalComponent component in the SAP NetWeaver software integration platform allows a hacker to execute arbitrary JavaScript code on the client side.

The vulnerability of the UpdateThemeVersionPortalComponent component in the SAP NetWeaver software integration platform exists due to insufficient cleaning of data entered by users when they are displayed on the journal viewing page. Exploiting this vulnerability allows a malicious actor to execu...