FortiPortal - XSS observed on policy column settings

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiPortal management interface may allow a remote authenticated attacker to perform a stored cross site scripting XSS attack via sending request with specially crafted columnindex parameter...

CVE-2022-46870

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported...

Cross site scripting

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported...

CVE-2022-46870 Apache Zeppelin: Stored XSS in note permissions

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported...

CVE-2022-34297: Improper Neutralization of Input During Web Page Generation

Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field...

Fortinet FortiOS Cross-Site Scripting Vulnerability (CNVD-2023-02487)

Fortinet FortiOS is a security operating system from Fortinet, a US-based company dedicated to the FortiGate network security platform. A cross-site scripting vulnerability exists in Fortinet FortiOS, which stems from improper input neutralization during web page generation and could be exploited...

CVE-2022-38379

Improper neutralization of input during web page generation CWE-79 in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may allow an authenticated attacker to inject HTML tags via input fields of various components within FortiSOAR...

Cross site scripting

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages...

CVE-2022-38379

Improper neutralization of input during web page generation CWE-79 in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may allow an authenticated attacker to inject HTML tags via input fields of various components within FortiSOAR...

CVE-2022-38379

Improper neutralization of input during web page generation CWE-79 in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may allow an authenticated attacker to inject HTML tags via input fields of various components within FortiSOAR...

CVE-2022-40680

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages...

FortiSOAR - HTML Injection Vulnerabilities

Improper neutralization of input during web page generation CWE-79 in FortiSOAR may allow an authenticated attacker to inject HTML tags via input fields of various components within FortiSOAR...

Stored cross-site scripting in replacement messages visualization

...

CVE-2021-31740: Improper Neutralization of Input During Web Page Generation

SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities XSS...

CVE-2021-37936: Improper Neutralization of Input During Web Page Generation

It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be render...

CVE-2022-38167: Improper Neutralization of Input During Web Page Generation

The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS...

CVE-2022-43754

CVE-2022-43754 describes an XSS vulnerability in spacewalk/Uyuni within the SUSE Manager Server ecosystem (SUSE Manager Server 4.2 and 4.3). The issue is caused by improper neutralization of input during web page generation, allowing remote attackers to embed Javascript via the path /rhn/audit/sc...

Cross site scripting

An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting XSS attack in the taxonomy management feature...

CVE-2022-39950

An improper neutralization of input during web page generation vulnerability CWE-79 exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4. Report templates may allow a low privilege level attacker to perform an XSS attack via...

CVE-2022-38373

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 may allow an authenticated user to perform a cross site scripting XSS attack via sending requests with specially crafted lure resource ID...