5290 matches found
Cross-Site Scripting (XSS)
jinja2 is vulnerable to Cross Site Scripting. An attacker is able to inject and execute arbitrary Javascript through the gettext and ngettext function due to the lack of output sanitization...
Zimbra Collaboration Server < 8.8.15 P11 / 9.x < 9.0.0 P4 XSS
According to its self-reported version number, Zimbra Collaboration Server is below 8.8.15 Patch 11, or 9.x prior to 9.0.0 Patch 4. It is, therefore, affected by a cross-site scripting XSS vulnerability in the Webmail component. An unauthenticated, remote attacker can exploit this, by convincing ...
IBM Content Navigator Cross-Site Scripting Vulnerability (CNVD-2020-62468)
IBM Content Navigator is a Web client that provides users with a console that enables them to access, manage, and use corporate content anytime, anywhere, from any location in the organization on virtually any mobile device. A stored cross-site scripting vulnerability exists in IBM Content...
CVE-2020-4760
IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188737...
Joplin Desktop Cross-Site Scripting Vulnerability
Joplin is an open source notes and to-do list application. A cross-site scripting vulnerability exists in Joplin Desktop version 1.2.6, which stems from the lack of proper validation of client-side data via a link in a note, and can be exploited by an attacker to inject JavaScript code into the...
Cross-site Scripting (XSS)
dompurify is vulnerable to Cross-Site ScriptingXSS. The vulnerability exists when converting from the SVG namespace, allowing an attacker to inject and execute arbitrary Javascript...
jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
A Cross-site scripting XSS vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the ‘HTML’ function to inject Javascript into the page where that input is rendered, and have it delivered by the browser...
jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
A Cross-site scripting XSS vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the ‘HTML’ function to inject Javascript into the page where that input is rendered, and have it delivered by the browser...
CVE-2020-27359
A cross-site scripting XSS issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a messag...
CVE-2020-27182
Multiple cross-site scripting XSS vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, jobjacketdetail.jsp, ixedit/editorcomponent.jsp, or the login form...
WSO API Manager Cross-Site Scripting Vulnerability
WSO2 API Manager is a suite of API lifecycle management solutions from WSO2, Inc. A cross-site scripting vulnerability exists in WSO2 API Manager version 3.1.0 and earlier versions, which originates from the failure to filter user input in the owner POST parameter of the administration interface ...
Cross-Site Scripting (XSS)
scratch-svg-renderer is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript via an SVG document due to the lack of escaping in the transformMeasurements function...
CVE-2020-7747 Cross-site Scripting (XSS)
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...
HUAWEI Mate 20 JavaScript Injection Vulnerability
Huawei Mate 20 is a smartphone from Chinese company Huawei Huawei. An injection vulnerability exists in previous versions of Huawei HUAWEI Mate 20 10.1.0.163 C00E160R3P8, which stems from a module that does not perform input checksums on specific inputs. An attacker can exploit this vulnerability...
CVE-2020-9092
HUAWEI Mate 20 versions earlier than 10.1.0.163C00E160R3P8 have a JavaScript injection vulnerability. A module does not verify a specific input. This could allow attackers to bypass filter mechanism to launch JavaScript injection. This could compromise normal service of the affected module...
CVE-2020-9092
HUAWEI Mate 20 versions earlier than 10.1.0.163C00E160R3P8 have a JavaScript injection vulnerability. A module does not verify a specific input. This could allow attackers to bypass filter mechanism to launch JavaScript injection. This could compromise normal service of the affected module...
CVE-2020-9092
CVE-2020-9092 affects Huawei Mate 20 devices running versions earlier than 10.1.0.163 (C00E160R3P8). The issue is a JavaScript injection vulnerability where a module does not verify specific input, allowing attackers to bypass the filter mechanism and inject JavaScript, potentially compromising t...
CVE-2019-13633
Blinger.io v1.0.2519 is vulnerable to Blind/Persistent XSS. An attacker can inject arbitrary JavaScript through built-in communication channels (Telegram, WhatsApp, Viber, Skype, Facebook, Vkontakte, Odnoklassniki), with exploitation impacting the admin-conversation panels: /conversations/all, /c...
Design/Logic Flaw
OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of...
