CVE-2019-1565

The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML...

CVE-2019-1566

The CVE-2019-1566 entry affects Palo Alto Networks PAN-OS: the Management Web Interface is vulnerable to cross-site scripting (XSS) due to insufficient input validation. Affects PAN-OS versions 7.1.21 and earlier, 8.0.14 and earlier, and 8.1.5 and earlier. An unauthenticated attacker could inject...

CVE-2019-1565

The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML...

CVE-2019-1565

The CVE-2019-1565 issue affects PAN-OS External Dynamic Lists. An authenticated user with write privileges can inject arbitrary JavaScript/HTML, impacting PAN-OS 7.1.x ≤7.1.21, 8.0.x ≤8.0.14, and 8.1.x ≤8.1.5. Remediation: upgrade to 7.1.22, 8.0.15, or 8.1.6 (or later). If not exploiting, no work...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the 1 c parameter or 2 a parameter...

CVE-2019-1566: Improper Neutralization of Input During Web Page Generation

The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML...

CVE-2019-1565: Improper Neutralization of Input During Web Page Generation

The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML...

Microsoft Windows .CONTACT File / HTML Injection Mailto: Remote Code Execution Vulnerability

Microsoft Windows is a popular operating system. A remote code execution vulnerability exists in Microsoft Windows .CCT File / HTML Injection Mailto:. The vulnerability is caused due to the processing of a ".contact" file, but the "email address" field uses the expected email address value. This...

UBUNTU-CVE-2019-6992

A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a long NAME or PROTOCOL to the index.php?view=controlcaps URI...

Microsoft Windows CONTACT - HTML Injection Remote Code Execution

Microsoft Windows CONTACT - HTML Injection Remote Code Execution + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-HTML-INJECTION-MAILTO-LINK-ARBITRARY-CODE-EXECUTION.txt + ISR: ApparitionSec ...

Microsoft Windows CONTACT - HTML Injection / Remote Code Execution

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-HTML-INJECTION-MAILTO-LINK-ARBITRARY-CODE-EXECUTION.txt + ISR: ApparitionSec + Zero Day Initiative Program + ZDI-CAN-7591 Vendor...

Microsoft Windows CONTACT - HTML Injection / Remote Code Execution Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-HTML-INJECTION-MAILTO-LINK-ARBITRARY-CODE-EXECUTION.txt Vendor www.microsoft.com Produ...

PT-2019-1347

Name of the Vulnerable Software and Affected Versions PAN-OS versions 7.1.21 and earlier PAN-OS versions 8.0.14 and earlier PAN-OS versions 8.1.5 and earlier Description The issue allows an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List...

Cross site scripting

A stored cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php...

CVE-2018-20729

A reflected cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php...

PT-2019-10190

Name of the Vulnerable Software and Affected Versions: NeDi versions prior to 1.7Cp3 Description: A stored cross site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the User-Chat.php file. Recommendations: For versions prior to 1.7Cp3, update to version...

Webmin cross-site scripting vulnerability (CNVD-2019-01675)

Webmin is a web-based system administration tool for Unix-like operating systems developed by Australian software developer Jamie Cameron and the Webmin community. A cross-site scripting vulnerability exists in Webmin version 1.890, which can be exploited by remote attackers to inject arbitrary W...

Multiple Cross-site Scripting (XSS) Vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in actionpack/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the 1 format, 2 negativeformat, or 3 units...

Nextcloud: Stored XSS/HTML injection in autocomplete suggestions for sharing

encrypted report, see attached GnuPG file. I tried to send this by mail, but [email protected] told me that I'm forced sic! to signup here. Please use 7F40 5A4F FAA3 F51B FEFD EE2F CE82 B2C8 6DCE BB9F to contact me. Impact encrypted report, see attached GnuPG file...

PT-2019-9270

Name of the Vulnerable Software and Affected Versions WordPress plugin spam-byebye versions 2.2.1 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For WordPress plugin spam-byebye versions 2.2.1 and earlier, updat...