CVE-2019-11198: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 300583 - List Manager Dashboard module, 2 307638 - Campaign Creator module, 3 316994 - Attributes field, 4 I316995 - Icon Selection module, 5...

CVE-2019-14550: Improper Neutralization of Input During Web Page Generation

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus...

PT-2019-13748

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.9 Description The issue allows for stored XSS execution when a victim clicks on the Edit Dashboard feature on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which fires wh...

Real Estate 7 < 2.9.1 - Stored XSS & IDOR

The 'Real Estate 7' premium WordPress theme is vulnerable to persistent XSS injection that allows an attacker to inject JavaScript or HTML code into the website front-end. There is also an Insecure Direct Object Reference issue, allowing unauthorized users to edit listings they should not have...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

CVE-2019-14298

Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Descriptionconfig field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx...

Cross-site Scripting (XSS)

Overview node-red-dashboard is a provides a set of nodes in Node-RED to quickly create a live data dashboard. Affected versions of this package are vulnerable to Cross-site Scripting XSS. Details Remediation Upgrade node-red-dashboard to version 2.17.0 or higher. References - GitHub Commit Credit...

@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.0.4), @telligro/opal-setup (>=0.3.0, <=0.3.1) +4 more potentially affected by CVE-2019-10756 via node-red-dashboard (>=2.3.11, <=2.15.0)

node-red-dashboard NPM version =2.3.11, =0.0.1, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2019-10756 Source advisory: SNYK:JS-NODEREDDASHBOARD-471939...

On the IoT road: perks, benefits and security of moving smartly

Kaspersky has repeatedly investigated security issues related to IoT technologies for instance, here, or here. Earlier this year our experts have even gained foothold in the security of biomechanical prosthetic devices. The same implies to smart car security: our own research has indicated that...

CVE-2019-11020: Missing Authentication for Critical Function

Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all claim details by visiting easily guessable dashboard/uploads/claimfiles/claimid URLs...

PT-2019-12142

Name of the Vulnerable Software and Affected Versions DDRT Dashcom Live version 2019-05-09 Description The issue is related to a lack of authentication in file-viewing components, allowing unauthorized remote access to claim details. This can be achieved by visiting easily guessable URLs, such as...

CVE-2019-1931

Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...

Cross site scripting

Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...

CVE-2019-1931: Improper Neutralization of Input During Web Page Generation

Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...

CVE-2019-1930: Improper Neutralization of Input During Web Page Generation

Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2019-21303)

Cisco Firepower Management Center FMC is a new generation of firewall management center software from Cisco. A cross-site scripting vulnerability exists in the RSS dashboard of the web-based management interface in Cisco FMC, which stems from the web-based management interface failing to adequate...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2019-21297)

Cisco Firepower Management Center FMC is a new generation of firewall management center software from Cisco. A cross-site scripting vulnerability exists in the RSS dashboard of the web-based management interface in Cisco FMC, which stems from the web-based management interface failing to adequate...

CVE-2016-5235

A Cross Site Scripting XSS vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an unauthenticated user to inject HTML via a crafted alert...

CVE-2016-5236

Cross-Site-Scripting XSS vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account or signature...

CVE-2016-5236

Cross-Site-Scripting XSS vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account or signature...