PT-2021-17675

Name of the Vulnerable Software and Affected Versions: IrisNext Edition version 9.5.16 Description: The issue allows an authenticated user to inject malicious JavaScript in folder or file names within the application, potentially leading to the execution of malicious code in other users' browsers...

IrisNext cross-site scripting vulnerabilities

IRIS IrisNext is a document management solution from IRIS Luxembourg designed to manage, protect and use your company's information. A security vulnerability exists in IrisNext that allows an authenticated or threatened user to inject malicious JavaScript into the application's folder filenames t...

CVE-2021-27930: Improper Neutralization of Input During Web Page Generation

Multiple stored XSS vulnerabilities in IrisNext Edition 9.5.16, which allows an authenticated or compromised user to inject malicious JavaScript in folder/file name within the application in order to grab other users’ sessions or execute malicious code in their browsers 1-click RCE...

MediaWiki suffers from an unspecified vulnerability (CNVD-2021-48984)

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki 1.36, which stems from a privileged user with Rewards...

CVE-2021-35208

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected...

CVE-2021-35207

An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode...

Security Bulletin: Using XSS attack, an attacker may inject Javascript code by modifying input fields in Datacap Navigator

Summary Using XSS attack, an attacker may inject Javascript code by modifying input fields in Datacap Navigator. Vulnerability Details CVEID: CVE-2020-4935 DESCRIPTION: IBM Datacap Fastdoc Capture is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript...

CVE-2021-36131

An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36. Within several special pages, a privileged user could inject arbitrary HTML and JavaScript within various data fields. The attack could easily propagate across many pages for many users...

Zimbra Collaboration Suite cross-site scripting vulnerability

Zimbra Collaboration Suite ZCS is a collaboration software suite that includes an email server and web client. A cross-site scripting vulnerability exists in the login component of the web client for Zimbra Collaboration Suite. An attacker could exploit this vulnerability by adding executable...

MediaWiki cross-site scripting vulnerabilities

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki 1.36 that stems from a privileged user being able to inject...

Zimbra Collaboration Suite cross-site scripting vulnerability

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A security vulnerability exists in versions prior to Zimbra Collaboration Suite 8.8.15 Patch 23, which can be exploited by an attacker to place HT...

CVE-2021-36130: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields. The attack could easily propagate acros...

Cross site scripting

IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196949...

IBM Planning Analytics cross-site scripting vulnerability

IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. A cross-site scripting vulnerability exists in IBM Planning Analytics Local, which stems from a...

Cross-Site Scripting (XSS)

jfinal is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the set method of the Controller class...

PT-2021-18400

Name of the Vulnerable Software and Affected Versions IBM Security Verify version 10.9.66 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session...

WordPress WP Google Maps plugin cross-site scripting vulnerability (CNVD-2021-49141)

WordPress is a set of open source blogging platforms developed using the PHP language by the WordPress Foundation. A stored cross-site scripting vulnerability exists in the WordPress WP Google Maps plugin. An attacker can exploit this vulnerability to execute client-side code by injecting...

Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat

✍️ Description The questionary section of livehelperchat can be modified listing new question . However, the template is used incorrectly resulting in a CSTI injection which leads to stored XSS. 🕵️‍♂️ Proof of Concept Install the livechat Go on...

CVE-2021-32536 MCU Technologies MCUsystem - Reflected XSS

The login page in the MCUsystem does not filter with special characters, which allows remote attackers can inject JavaScript without privilege and thus perform reflected XSS attacks...

CVE-2021-32536

Summary: CVE-2021-32536 affects the MCUsystem login page, where input is not filtered for special characters. This allows a remote attacker to inject JavaScript and perform a reflected XSS attack. The vulnerability is described across several sources (NVD, CVE list) as a login-page input validati...