keycloak: security headers missing on REST endpoints

A flaw was found in Keycloak’s Admin Console, where it is missing HTTP security headers in HTTP responses. This issue is not a direct vulnerability and may not lead to a security issue, but increases the chances of allowing attackers to exploit other security flaws. Examples of these possible...

SAP Business Objects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2020-48591)

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. A cross-site scripting vulnerability exists in SAP Business Objects...

GitLab Cross-Site Scripting Vulnerability (CNVD-2020-46291)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in tooltip in...

vBulletin Cross-Site Scripting Vulnerability

vBulletin is the United States InternetBrands and vBulletinSolutions, Inc. of a PHP and MySQL-based open source Web forum program . A cross-site scripting vulnerability exists in vBulletin version 5.x. The vulnerability stems from the lack of proper validation of client-side data by the WEB...

MantisBT Cross-Site Scripting Vulnerability (CNVD-2020-46791)

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in MantisBT versions prior to 2.24.2. The vulnerability stems from the...

SOPlanning Cross-Site Scripting Vulnerability

SOPlanning is an online project management software. A cross-site scripting vulnerability exists in SOPlanning version 1.46.01. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute client-side co...

GitLab Cross-Site Scripting Vulnerability (CNVD-2020-46489)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in Issues in...

PT-2020-3824 · Microsoft · Windows Csc Service +1

Name of the Vulnerable Software and Affected Versions: Windows CSC Service affected versions not specified Description: The issue is related to the improper handling of memory by the Windows CSC Service, which can lead to an elevation of privilege. To exploit this, an attacker must first gain...

BugPoC: DOM based Cross-site Scripting

Summary: The postMessage API is an alternative to JSONP, XHR with CORS headers and other methods enabling sending data between origins. It was introduced with HTML5 and like many other cross-document features it can be a source of client-side vulnerabilities. Steps To Reproduce: Visit -...

Jeedom Cross-Site Scripting Vulnerability

Jeedom is an open source home automation solution for the Internet of Things. A cross-site scripting vulnerability exists in Jeedom 4.0.38 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the...

Plesk Obsidian Cross-Site Scripting Vulnerability

Plesk Obsidian is a mainframe control panel from the Swiss company Plesk. A cross-site scripting vulnerability exists in Plesk Obsidian version 18.0.17. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability ...

Tiki Cross-Site Scripting Vulnerability (CNVD-2020-44400)

Tiki is a suite of open source content management and portal applications from the Tiki community that can be used to create web applications, portals, corporate intranets, extranets, and more. A cross-site scripting vulnerability exists in versions prior to Tiki 21.2. The vulnerability stems fro...

Plesk Onyx Cross-Site Scripting Vulnerability

Plesk Onyx is a hosting control panel from the Swiss company Plesk. A cross-site scripting vulnerability exists in Plesk Onyx version 17.8.11. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability to execute...

GitLab: Store-XSS in error message of build-dependencies

Hi, A stored-XSS is existing in error message of build-dependencies. Fortunately it currently does not exist in gitlab.com. It seems that gitlab.com disables the dependencies validation. However this feature is enable by default in self-managed installation. Steps to reproduce The following steps...

TYPO3 dlf extension cross-site scripting vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. dlf extension is one of the digital library extensions. A cross-site scripting vulnerability exists in TYPO3 dlf extension version 3.1.1 and earlier versions, which stems from the lack of...

Nagios Log Server Cross-Site Scripting Vulnerability (CNVD-2020-43761)

Nagios Log Server is a set of centralized log management, monitoring and analysis software from Nagios, Inc. A cross-site scripting vulnerability exists in Nagios Log Server versions prior to 2.1.7. The vulnerability stems from the lack of proper validation of client-side data by the WEB...

KonaWiki Cross-Site Scripting Vulnerability

KonaWiki is a lightweight Wiki system. The system is primarily used for writing manuscripts, keeping minutes and memos, etc. A cross-site scripting vulnerability exists in KonaWiki 2.2.0 and earlier versions. The vulnerability stems from the WEB application lacking proper validation of client-sid...

KonaWiki cross-site scripting vulnerability (CNVD-2020-43669)

KonaWiki is a lightweight Wiki system. The system is primarily used for writing manuscripts, keeping minutes and memos, etc. A cross-site scripting vulnerability exists in KonaWiki 3.1.0 and earlier versions. The vulnerability stems from the WEB application lacking proper validation of client-sid...

CVE-2020-15588

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM...

CVE-2020-15588

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM...