PT-2020-18534

Name of the Vulnerable Software and Affected Versions WL-Enq versions 1.11 through 1.12 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions 1.11 and 1.12, update to a version that contains a fix for this issue...

CVE-2020-5557: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2020-18527

Name of the Vulnerable Software and Affected Versions mailform version 1.04 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which can lead to cross-site scripting. Recommendations For mailform version 1.04, consider disabling the featu...

CVE-2020-5552: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2020-5559: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in WL-Enq 1.11 and 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2020-5339: Improper Neutralization of Input During Web Page Generation

RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript...

Stored XSS via malicious file upload - CVE-2020-14173

The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability. Affected versions version 8.5.4 8.6.0 ≤ version ≤ 8.7.0 8.7.0 ≤ version 8.7.1 Fixed versions 8.5.4 8.7...

Grandstream UCM6200 SQL Injection Vulnerability (CNVD-2020-23201)

The Grandstream UCM6200 is an enterprise-class switch for IP telephony communications from Grandstream. An SQL injection vulnerability exists in the HTTP interface of the Grandstream UCM6200 versions prior to 1.0.19.20 and 1.0.20.17, which can be exploited by an attacker to execute shell commands...

CVE-2020-5722

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions befo...

CVE-2019-15510

ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...

CVE-2019-15510

ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...

Design/Logic Flaw

ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...

CVE-2019-15510

ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...

CVE-2019-15510

Zoho ManageEngine Desktop Central 10 is affected by an HTML-injection vulnerability in the user administration page. The root cause is unsanitized input in the role description field during role creation, which can be reflected on the page and potentially executed in the user’s context. Affected ...

CVE-2020-5722

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions befo...

PT-2020-9704 · Zoho · Zoho Manageengine Desktop Central

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Desktop Central version 10 Description: The issue allows HTML injection on the user administration page via the description of a role. This is achieved by exploiting the description variable in the role creation process. The...

CVE-2019-15510: Improper Neutralization of Input During Web Page Generation

ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...

PT-2020-6384

Name of the Vulnerable Software and Affected Versions Grandstream UCM6200 series versions prior to 1.0.19.20 Grandstream UCM6200 series versions prior to 1.0.20.17 Description The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted...

CVE-2020-5722: Improper Neutralization of Special Elements used in an SQL Command

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions befo...

Razer: HTML injection in support.razer.com [IE only]

The tester discovered the support.razer.com site had an HTML injection vulnerability that could have facilitated a phishing attack. Razer thanks the tester for his report and for working with the team to help remediate...