Atlassian JIRA Server Cross-Site Scripting Vulnerability (CNVD-2018-18120)

Atlassian JIRA Server is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of problems and defects in the work. A cross-site scripting vulnerability exists in the IncomingMailServers resource in Atlassian JIRA Server. A remote...

CVE-2017-17541

A Cross-site Scripting XSS vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature...

CVE-2018-5229

The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of user submitted add-on names...

macOS/iOS - JavaScript Injection Bug in OfficeImporter

QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code using OfficeImport and renders it using WebKit. The...

macOSiOS - JavaScript Injection Bug in OfficeImporter

macOSiOS - JavaScript Injection Bug in OfficeImporter QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code...

macOS / iOS - JavaScript Injection Bug in OfficeImporter Exploit

Exploit for multiple platform in category dos / poc QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code usi...

Shopify: Preview bar: Incomplete message origin validation results in XSS

The JavaScript code at https://cdn.shopify.com/s/assets/storefront/bars/previewbarinjector-73a4756a265c637c998799750759ae548e7f68b136e8e93e83132904afc3d30d.js loaded by the shop front when a theme is previewed installs a message event listener. The following check is used to reject invalid event...

IBM Rational Team Concert Cross-Site Scripting Vulnerability (CNVD-2018-23254)

IBM Rational Team Concert RTC is the U.S. IBM's set of Jazz-based platform and support for decentralized teams for real-time collaboration related to software lifecycle management solutions. A cross-site scripting vulnerability exists in IBM RTC versions 5.0 through 5.0.2 and 6.0 through 6.0.5. A...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-23251)

IBM Rational Quality Manager is the collaborative center for business-driven software and system quality across virtually any platform and any type of test. The software helps teams seamlessly share information, use automation to accelerate projects, and report metrics for targeted release...

Fortinet FortiAnalyzer Cross-Site Scripting Vulnerability (CNVD-2018-13761)

Fortinet FortiManager and FortiAnalyzer are both products of Fortinet, Inc. Fortinet FortiManager is a centralized network security management solution.FortiAnalyzer is a centralized network security reporting solution. A cross-site scripting vulnerability exists in Fortinet FortiManager version...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-23248)

IBM Rational Quality Manager is the collaborative center for business-driven software and system quality across virtually any platform and any type of test. The software helps teams seamlessly share information, use automation to accelerate projects, and report metrics for targeted release...

Pornhub: Stored XSS on the https://www.redtube.com/users/[profile]/collections

Researcher successfully closed the image 'alt' attribute and injected javascript by submitting an XSS payload as the collection title. This led to stored cross-site scripting on the user's collections page, executed against any users who visited the user's collections. The user's favorites page w...

Stored Cross-site Scripting Vulnerabilities in Qingdao Easoft Tianchuang Ranzhi Collaboration Management System (QDTMS)

Ranch Coworking Management System is an enterprise coworking system. A stored cross-site scripting vulnerability exists in several places in Ranzhi Collaboration Management System. Attackers can insert malicious js code in the page to get user cookies and other information, resulting in user...

IBM FileNet Content Manager Cross-Site Scripting Vulnerability (CNVD-2018-13447)

IBM FileNet Content Manager is a content management solution for the FileNet P8 platform from IBM USA. The solution combines document management with ready-to-use workflow tools to manage images, video, Web content, compliance documents, and more. A cross-site scripting vulnerability exists in IB...

Jirafeau cross-site scripting vulnerability (CNVD-2018-13451)

Jirafeau is a file sharing website system. A cross-site scripting vulnerability exists in the search file by name form in Jirafeau versions prior to 3.4.1. A remote attacker can exploit this vulnerability to inject JavaScript and manipulate the user session...

IBM Planning Analytics Cross-Site Scripting Vulnerability

IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. A cross-site scripting vulnerability exists in IBM Planning Analytics versions 2.0.0 through 2.0.4...

IBM RQM/RCLM Cross-Site Scripting Vulnerability (CNVD-2018-12635)

IBM Rational Quality Manager is a Web-based collaborative quality management solution.IBM Rational Collaborative Lifecycle Management is an application lifecycle management solution. A cross-site scripting vulnerability exists in the implementation of IBM Rational Quality Manager and IBM Rational...

PAN-OS cross-site scripting vulnerability (CNVD-2018-13464)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A cross-site scripting vulnerability exists in the PAN-OS session browser in Palo Alto Networks PAN-OS. An attacker could exploit this vulnerability to inject arbitrary JavaScript...

PAN-OS cross-site scripting vulnerability (CNVD-2018-13468)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A cross-site scripting vulnerability exists in the PAN-OS Web interface administration page in Palo Alto Networks PAN-OS. An attacker could exploit this vulnerability to inject...

CVE-2018-9337

The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML...