PT-2019-17078

Name of the Vulnerable Software and Affected Versions IBM Case Manager versions 5.1.1 through 5.3 The Case Builder component versions 18.0.0.1 through 19.0.0.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially...

Webform - Critical - Multiple vulnerabilities - SA-CONTRIB-2019-096

This module enables you to create forms to collect information from users and report, analyze and distribute it by email. The 7.x-3.x module doesn't sufficiently sanitize token values taken from query strings. If a query string token is used as the value of a markup component, an attacker can...

IBM WebSphere Application Server Liberty Cross-Site Scripting Vulnerability

IBM WebSphere Application Server Liberty is a U.S. IBM company built on the Open Liberty project on top of the Java application server . A cross-site scripting vulnerability exists in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 19.0.0.11. A remote attacker can exploit this...

PT-2019-17148

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server - Liberty affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosu...

Cross site scripting

IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

IBM Planning Analytics Cross-Site Scripting Vulnerability (CNVD-2019-44562)

IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. A cross-site scripting vulnerability exists in IBM Planning Analytics version 2.0. An attacker can...

PT-2019-17141

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics version 2.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

Cross-Site Scripting (XSS)

gitbook is vulnerable to cross-site scripting XSS. An attacker is able to inject arbitrary Javascript into a victim's browser using a local .md file which is rendered when displayed on the browser...

Cross-Site Scripting (XSS)

devalue is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript on a victim's browser using a malicious regular expression containing Javascript...

Cross-Site Scripting (XSS)

jetty-server is vulnerable to cross-site scripting. The server response containing the default error message from stacktraces is not sanitized and escaped before being displayed, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser...

PT-2019-16979

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak System versions 2.3 through 2.3.0.1 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

PT-2019-17096

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak System versions 2.3 through 2.3.0.1 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

IBM Cloud Pak System Platform System Manager Cross-Site Scripting Vulnerability

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. A cross-site scripting vulnerability exists in Platform System Manager in IBM...

Cross-Site Scripting (XSS)

vuetify is vulnerable to cross-site scripting XSS attacks. The user inputs are directly rendered and executed as HTML without sanitation in 'VInput.ts', allowing an attacker to inject arbitrary Javascript...

PT-2019-17133

Name of the Vulnerable Software and Affected Versions IBM Tivoli Netcool Impact versions 7.1.0.0 through 7.1.0.16 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

PT-2020-9945

Name of the Vulnerable Software and Affected Versions Moodle versions 3.7.2 and earlier Description The issue allows authenticated users, such as those with a Teacher role or above, to inject JavaScript into another user's session, including enrolled students or site administrators, via the...

FreeBSD : wordpress -- multiple issues (459df1ba-051c-11ea-9673-4c72b94353b5)

wordpress developers reports : Props to Evan Ricafort for finding an issue where stored XSS cross-site scripting could be added via the Customizer. rops to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts. Props to Weston Ruter for finding a way to create a stored XSS...

GHSA-XV69-F7X5-R4QW Magento Cross-Site Scripting via Attribute Set Name

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into the attribute set name when listing the products...

IBM Cognos Analytics Cross-Site Scripting Vulnerability (CNVD-2019-40462)

IBM Cognos Analytics is a suite of business intelligence software from IBM USA that provides you with valuable information, secure data governance and reporting. A cross-site scripting vulnerability exists in IBM Cognos Analytics versions 11.0 through 11.1, which can be exploited by a remote...

PT-2019-17090

Name of the Vulnerable Software and Affected Versions IBM QRadar versions 7.3.0 through 7.3.2 Patch 4 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...