CVE-2019-12843: Improper Control of Generation of Code

A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3...

CVE-2019-12844: Improper Control of Generation of Code

A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3...

OLX: Reflected XSS on www.olx.co.id via ad_type parameter

I have identified a Reflected Cross Site Scripting XSS vulnerability on the www.olx.co.id website. Vulnerable URL: https://www.olx.co.id/iklan/sony-xz-ram-3gb-32gb-finger-mulus-preisure-naik-test-air-disini-IDA2UED.html?adtype=OR"/alert"XSS" Vulnerable Parameter: skeyword XSS Payload:...

CVE-2019-1577

Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML...

PowerPanel Business Edition 3.4.0 Cross Site Scripting

Exploit Title: PowerPanel Business Edition - Stored Cross Site Scripting SNMP trap receivers Google Dork: None Date: 6/29/2019 Exploit Author: Joey Lane Vendor Homepage: https://www.cyberpowersystems.com Software Link: https://dl4jz3rbrsfum.cloudfront.net/software/ppbe340-linux-x8664.sh Version:...

IBM Rational Collaborative Lifecycle Management Cross-Site Scripting Vulnerability (CNVD-2019-21081)

IBM Rational Collaborative Lifecycle Management CLM is a suite of collaborative lifecycle management solutions from IBM in the United States. The solution combines three products, RTC, RQM, and RRC, in a single IBM SmartCloud Enterprise cloud environment image to provide requirements management,...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2019-20857)

IBM Rational Collaborative Lifecycle Management CLM is a suite of collaborative lifecycle management solutions from IBM in the United States. The solution combines three products, RTC, RQM, and RRC, in a single IBM SmartCloud Enterprise cloud environment image to provide requirements management,...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2019-20850)

IBM Rational Collaborative Lifecycle Management CLM is a suite of collaborative lifecycle management solutions from IBM in the United States. The solution combines three products, RTC, RQM, and RRC, in a single IBM SmartCloud Enterprise cloud environment image to provide requirements management,...

PT-2019-2816

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Traps versions 5.0.5 and earlier Description The issue is related to incorrect code generation management in Palo Alto Networks Traps, which may allow an authenticated attacker to inject arbitrary JavaScript or HTML. This...

PT-2019-9569 · Ibm · Ibm Rational Collaborative Lifecycle Management

Name of the Vulnerable Software and Affected Versions: IBM Rational Collaborative Lifecycle Management versions 6.0 through 6.0.6.1 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

IBM Security Access Manager Appliance Cross-Site Scripting Vulnerability

IBM Security Access Manager Appliance ISAM Appliance is a network appliance-based security solution from IBM, USA. The product is mainly used for access control and Web-based threat protection, providing system performance monitoring, log analysis and diagnosis. A cross-site scripting vulnerabili...

PT-2019-12983

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2018.2.3 Description A possible stored JavaScript injection issue was detected on one of the JetBrains TeamCity pages. Recommendations For versions prior to 2018.2.3, update to version 2018.2.3 or later to...

CVE-2019-19908

phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmcusername parameter to passreset.php is vulnerable. Recent assessments: cinzinga at March 09, 2020 9:23pm UTC reported: I am the founder of this exploit. Google dorking...

PT-2019-12982

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2018.2.3 Description A possible stored JavaScript injection was detected, requiring a deliberate server administrator action. Recommendations For versions prior to 2018.2.3, update to version 2018.2.3 or...

IBM Cognos Controller Cross-Site Scripting Vulnerability

IBM Cognos Controller is a suite of business intelligence and planning solutions from IBM in the United States. The product features process automation, financial audit control, and the creation and management of financial reports. A cross-site scripting vulnerability exists in IBM Cognos...

PT-2019-12293

Name of the Vulnerable Software and Affected Versions FusionPBX version 4.4.3 Description The issue allows remote unauthenticated attackers to inject arbitrary JavaScript characters by placing a phone call using a specially crafted caller ID number, potentially leading to remote code execution wh...

PT-2019-16917 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 10.2.0 through 10.4.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

Cross-site Scripting (XSS)

Apache Sling is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize appenderName in the function renderAppenderContent of SlingLogPanel, allowing a remote attacker to inject arbitrary Javascript into a victim's browser...

CVE-2019-10336

A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin...

Cross site scripting

A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in the plugin-provided output on build status pages...