CVE-2019-17127

A Stored Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation...

CVE-2019-17125

A Reflected Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS...

CVE-2019-17125

A Reflected Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS...

Cross site scripting

A Reflected Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS...

CVE-2019-17127

Summary: CVE-2019-17127 describes a Stored Client Side Template Injection (CSTI) in SolarWinds Orion Platform 2019.2 HF1. The vulnerability allows an attacker to inject an Angular expression and escape the Angular sandbox, causing stored XSS and potential privilege escalation. The affected compon...

Transcend WiFiSD Cross-Site Scripting Vulnerability

Transcend WiFiSD is a WiFi-enabled memory card product from Transcend Taiwan, China. A cross-site scripting vulnerability exists in Transcend WiFiSD version 1.8. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the...

WordPress flog cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress flog version 0.1. The vulnerability stems from a lack...

ovirt-engine cross-site scripting vulnerability

ovirt-engine is an open source virtualization management engine. A cross-site scripting vulnerability exists in ovirt-engine. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Cayin SMP-PRO4 Cross-Site Scripting Vulnerability

The Cayin SMP-PRO4 is a digital signage player. A cross-site scripting vulnerability exists in Cayin SMP-PRO4. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Cross site scripting

Symantec Endpoint Detection and Response SEDR, prior to 4.3.0, may be susceptible to a cross site scripting XSS issue. XSS is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. An XSS vulnerability may be used by attackers to potentially...

TopList Cross-Site Scripting Vulnerability

TopList is a content aggregation website system written in Go for getting popular headlines from other websites. A cross-site scripting vulnerability exists in versions of TopList prior to 2019-09-03. The vulnerability stems from the WEB application's lack of proper validation of client-side data...

OpenTrade Cross-Site Scripting Vulnerability

OpenTrade is an open source cryptocurrency trading platform. A cross-site scripting vulnerability exists in OpenTrade 0.2.0 and prior versions. The vulnerability stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploit the vulnerability to execute...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-01242)

Ignite Realtime Openfire is the Ignite Realtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open source real-time collaboration RTC server , it can build a highly efficient instant messaging server , and supports tens of...

Juniper Networks Junos OS Cross-Site Scripting Vulnerability (CNVD-2020-03713)

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The OS provides a secure programming interface and the Junos SDK. A cross-site scripting vulnerability exists in J-Web in Juniper Networks Junos OS, which arises from a lack of proper...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-01243)

Ignite Realtime Openfire is the Ignite Realtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open source real-time collaboration RTC server , it can build a highly efficient instant messaging server , and supports tens of...

Electronic Logbook (ELOG) Cross-Site Scripting Vulnerability

ELOG is a web application written in C for creating personal and general logs. A cross-site scripting vulnerability exists in ELOG version 3.1.4. The vulnerability stems from the WEB application's lack of proper validation of client-side data. An attacker can exploit the vulnerability to execute...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-01244)

Ignite Realtime Openfire is the Ignite Realtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open source real-time collaboration RTC server , it can build a highly efficient instant messaging server , and supports tens of...

CVE-2019-20183

uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension...

CVE-2019-14918

XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via crafted DHCP request packets to etcro/web/internet/dhcpcliinfo.asp...

PrestaShop cross-site scripting vulnerability (CNVD-2020-02542)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A cross-site scripting vulnerability exists in PrestaShop version 1.7.6.2. The...