CVE-2021-42838

Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...

PHP Laravel 8.70.1 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: PHP Laravel 8.70.1 - Cross Site Scripting XSS to Cross Site Request Forgery CSRF Date: 14/11/2021 Exploit Author: Hosein Vita Vendor Homepage: https://laravel.com/ Software Link: https://laravel.com/docs/4.2 Version: Laravel Framework 8.70.1 Tested on: Windows/Linux Description: We...

Xin Xue Ying Information webopac7 Cross-site Scripting Vulnerability

XinXueYing Info Webopac7 is an online public access catalog of China XinXueYing Info. It is used for users to access library services over the Internet. A cross-site scripting vulnerability exists in XinXueYing Info webopac7, which originates from a book search field parameter that does not...

PT-2021-22348

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager versions 3.0 through 4.1 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trust...

PT-2021-12115

Name of the Vulnerable Software and Affected Versions: IBM Security SiteProtector System version 3.1.1 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

Cross-site Scripting (XSS)

graphql-playground-react is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in Properties.html allowing an attacker to inject and execute malicious javascript...

Cross-site Scripting (XSS)

grafana is vulnerable to cross-site scripting attacks. The vulnerability exists due to lack of sanitation of URL allowing a malicious attacker to inject and execute arbitrary javascript...

Publify cross-site scripting vulnerabilities

Publify is a simple but full-featured web publishing software. A security vulnerability exists in Publify versions v8.0 through v9.2.4, which can be exploited by an attacker to insert and execute arbitrary JavaScript code during page/post creation...

Publify

Publify is a simple but full-featured web publishing software. A security vulnerability exists in Publify versions v8.0 through v9.2.4, which can be exploited by attackers to inject malicious JavaScript via an uploaded html file...

CVE-2021-35488

Thruk 2.40-2 allows /thruk/cgi-bin/status.cgi?style=combined&title=TITLE Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it...

Cross site scripting

Thruk 2.40-2 allows /thruk/cgi-bin/status.cgi?style=combined&title=TITLE Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it...

CVE-2021-42703

This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action...

Thruk cross-site scripting vulnerabilities

Thruk is an open source multi-backend monitoring web interface from the individual developer Sven Nierlein in Germany. Thruk 2.40-2 suffers from a security vulnerability that allows an attacker to inject arbitrary JavaScript into status.cgi, which triggers a payload every time an authenticated us...

Cross-site Scripting (XSS)

apostrophe is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in index.js allowing an attacker to insert arbitrary Javascript...

PT-2021-12118

Name of the Vulnerable Software and Affected Versions: IBM QRadar Network Security versions 5.4.0 through 5.5.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

Mozilla Firefox Security Advisory (MFSA2020-05) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

PT-2021-22122

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the name parameter of the "API schedule" endpoint, which may enable remote code execution...

PT-2021-22161

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the comment parameter of the API events, which may enable remote code execution. Recommendatio...

PT-2021-22115

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the deviceName parameter of the "modbusWriter-Reader" API, potentially enabling remote code...

CVE-2021-36332

Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability. A remote low privileged attacker, may potentially exploit this vulnerability, directing end user to arbitrary and potentially malicious websites...