CVE-2021-34817

CVE-2021-34817 is a documented XSS in Etherpad 1.8.13 where the chat message userId is rendered into HTML without escaping, enabling a crafted pad import to execute arbitrary JavaScript in an admin’s browser. The SonarSource write-up confirms the root cause is an unescaped userId in the chat fron...

PT-2021-14017

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Docker version 10.0.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

Cross-Site Scripting (XSS)

stacktable.js is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via several elements.,...

CVE-2021-24427

The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue...

PT-2021-18504

Name of the Vulnerable Software and Affected Versions IBM Tivoli Netcool/OMNIbus GUI version 8.1.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

IBM Cloud Pak for Automation Cross-Site Script Vulnerabilities

IBM Cloud Pak for Automation is an intelligent software platform used to build automation applications in cloud environments from IBM USA. The platform uses pre-integrated automation technologies and low-code tools to design, build, and run automation applications and services on any cloud.A...

PT-2021-18486

Name of the Vulnerable Software and Affected Versions IBM Tivoli Netcool/OMNIbus GUI version 8.1.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session...

pfSense Cross-Site Scripting Vulnerability

pfSense is a set of network firewalls based on FreeBSD Linux. A cross-site scripting vulnerability exists in Netgate pfSense, which allows an attacker to inject malicious JavaScript code into a description text box or parameter...

PT-2021-17675

Name of the Vulnerable Software and Affected Versions: IrisNext Edition version 9.5.16 Description: The issue allows an authenticated user to inject malicious JavaScript in folder or file names within the application, potentially leading to the execution of malicious code in other users' browsers...

CVE-2021-27930: Improper Neutralization of Input During Web Page Generation

Multiple stored XSS vulnerabilities in IrisNext Edition 9.5.16, which allows an authenticated or compromised user to inject malicious JavaScript in folder/file name within the application in order to grab other users’ sessions or execute malicious code in their browsers 1-click RCE...

MediaWiki suffers from an unspecified vulnerability (CNVD-2021-48984)

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki 1.36, which stems from a privileged user with Rewards...

IrisNext cross-site scripting vulnerabilities

IRIS IrisNext is a document management solution from IRIS Luxembourg designed to manage, protect and use your company's information. A security vulnerability exists in IrisNext that allows an authenticated or threatened user to inject malicious JavaScript into the application's folder filenames t...

CVE-2021-35208

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected...

CVE-2021-35207

An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode...

Security Bulletin: Using XSS attack, an attacker may inject Javascript code by modifying input fields in Datacap Navigator

Summary Using XSS attack, an attacker may inject Javascript code by modifying input fields in Datacap Navigator. Vulnerability Details CVEID: CVE-2020-4935 DESCRIPTION: IBM Datacap Fastdoc Capture is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript...

CVE-2021-36131

An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36. Within several special pages, a privileged user could inject arbitrary HTML and JavaScript within various data fields. The attack could easily propagate across many pages for many users...

MediaWiki cross-site scripting vulnerabilities

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki 1.36 that stems from a privileged user being able to inject...

Zimbra Collaboration Suite cross-site scripting vulnerability

Zimbra Collaboration Suite ZCS is a collaboration software suite that includes an email server and web client. A cross-site scripting vulnerability exists in the login component of the web client for Zimbra Collaboration Suite. An attacker could exploit this vulnerability by adding executable...

Zimbra Collaboration Suite cross-site scripting vulnerability

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A security vulnerability exists in versions prior to Zimbra Collaboration Suite 8.8.15 Patch 23, which can be exploited by an attacker to place HT...

CVE-2021-36130: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields. The attack could easily propagate acros...