TOTOLINK A3002RU cross-site scripting vulnerability (CNVD-2018-24105)

TOTOLINK A3002RU is a wireless router product from Gion Electronics TOTOLINK. A cross-site scripting vulnerability exists in the password.htm page in TOTOLINK A3002RU version 1.0.8. A remote attacker can exploit this vulnerability to execute arbitrary JavaScript code with the help of a username...

CVE-2018-13349: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's username...

CVE-2018-13334: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...

CVE-2018-13360: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter...

PT-2018-11779

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript, potentially leading to cross-site scripting. This is achieved via the modgroup parameter in the usertable.php file. Recommendations For TerraMaster TO...

PT-2018-11771

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript via the edit password form in the Control Panel, potentially leading to cross-site scripting. Recommendations For TerraMaster TOS version 3.1.03, updat...

PT-2018-11759

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript when viewing shared folders via their descriptions, due to cross-site scripting in the Control Panel. Recommendations For TerraMaster TOS version 3.1.0...

PT-2018-11755

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames, due to cross-site scripting in the Control Panel. Recommendations For TerraMaster TOS...

CVE-2018-13309

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...

PT-2018-11731

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to execute arbitrary JavaScript by modifying the User phrases button field in notice gen.htm, potentially leading to cross-site scripting. Recommendations For TOTOLINK A3002...

CVE-2018-13323: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in detail.html in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute JavaScript via the "username" cookie...

PT-2018-11736

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to execute arbitrary JavaScript by modifying the Input your notice URL field in notice gen.htm, potentially leading to cross-site scripting. Recommendations For TOTOLINK...

PT-2018-11747

Name of the Vulnerable Software and Affected Versions Buffalo TS5600D1206 version 3.61-0.10 Description The issue allows attackers to execute JavaScript via the username cookie, potentially leading to cross-site scripting attacks. Recommendations For Buffalo TS5600D1206 version 3.61-0.10, conside...

Debian DLA-1592-1 : otrs2 security update

Two security vulnerabilities were discovered in OTRS, a Ticket Request System, that may lead to privilege escalation or arbitrary file write. CVE-2018-19141 An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS...

Valine HTML Injection

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file...

CVE-2018-19351

Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py,...

Design/Logic Flaw

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file...

CVE-2018-19289

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file...

CVE-2018-19289

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file...

CVE-2018-19289

Valine v1.3.3 is affected by CVE-2018-19289: HTML injection can be triggered via an EMBED element in conjunction with a .pdf file, enabling JavaScript execution. Connected sources (GHSA/OSV) corroborate HTML injection in Valine and mention the embed policy bypass. No remediation/version patch det...