Cross-site Scripting (XSS)

mvcbean-jsp-portlet-archetype is vulnerable to cross-site scripting. The library does not properly escape the user input firstName and lastName parameters in greeting.jspx, allowing an attacker to inject and execute malicious javascript...

PT-2022-15253

Name of the Vulnerable Software and Affected Versions Directus versions 9.0.0-alpha.4 through 9.4.1 Description The issue is related to a stored Cross-Site Scripting XSS vulnerability via SVG file upload in the media upload functionality. A low-privileged attacker can inject arbitrary JavaScript...

CVE-2022-22116: Improper Neutralization of Input During Web Page Generation

In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting XSS vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image...

CVE-2021-43942

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting XSS vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting...

OroPlatform injection vulnerability

OroPlatform is a PHP Business Application Platform BAP designed to make the development of custom business applications easier and faster. OroPlatform suffers from a security vulnerability that stems from the software's lack of effective filtering and escaping of JavaScript attributes. By sending...

CVE-2021-43942: Improper Neutralization of Input During Web Page Generation

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting XSS vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting...

PT-2022-12419

Name of the Vulnerable Software and Affected Versions Web Viewer for Hanwha DVR version 2.17 Description The issue allows an attacker to inject malicious JavaScript codes due to a Cross Site Scripting XSS vulnerability. Recommendations For Web Viewer for Hanwha DVR version 2.17, consider disablin...

Cross-site Scripting (XSS) - Stored in zikula/core

Description When inputting a name for a module category whether editing an existing one or adding a new one, you're able to inject your own Javascript, leading to it being executed. An example payload that you can enter is: xss and then each time that you click the category to expand it, your...

PT-2021-22304

Name of the Vulnerable Software and Affected Versions IBM i versions 7.2 through 7.4 Description This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. Recommendation...

CVE-2021-45812

NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting XSS vulnerability. An attacker can steal the user's session by injecting malicious JavaScript codes which leads to session hijacking...

Cross site scripting

A persistent cross-site scripting XSS issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268...

PT-2021-22335

Name of the Vulnerable Software and Affected Versions IBM OPENBMC OP910 affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

CVE-2021-38966

IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212357...

Cross-site Scripting (XSS)

epiphany is vulnerable to cross-site scripting. An attacker is able to exploit the vulnerability by getting a user to visit an XSS payload page often enough to place that page on the most visited list to inject and execute arbitrary javascript...

Fresenius Kabi Agilia Connect Infusion System cross-site scripting vulnerability

Fresenius Kabi Agilia Connect Infusion System is an infusion system from the German company Fresenius Kabi.A cross-site scripting vulnerability exists in Fresenius Kabi Agilia Connect Infusion System, which can be exploited by attackers to inject JavaScript into the GET parameter of HTTP request'...

CVE-2021-44163

Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaScript injection for XSS reflected Cross-site scripting attack without authentication...

Cross site scripting

Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaScript injection for XSS reflected Cross-site scripting attack without authentication...

Chain Sea Ai Chatbot System Cross-site Scripting Vulnerability

Chain Sea Ai Chatbot System is an intelligent human customer service software from Chain Sea, China. Chain Sea Ai Chatbot System is vulnerable to a cross-site scripting vulnerability, which is caused by the product not filtering special characters in URL parameters and can be exploited for JS...

PT-2021-24057

Name of the Vulnerable Software and Affected Versions: Chain Sea ai chatbot backend affected versions not specified Description: The issue is related to improper filtering of special characters in URL parameters, allowing a remote attacker to perform JavaScript injection for a reflected Cross-sit...

UiPath Assistant injection vulnerability

UiPath Assistant is a specialized tool for UiPath designed to make it easy and fun for users to interact with bots from the desktop. UiPath Assistant 21.4.4 suffers from a security vulnerability that stems from user control data provided to the --process-start parameter of the uipath-assistant://...