CVE-2021-38708

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS...

CVE-2021-38709

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staffmessaging messaging system for XSS...

CVE-2021-38709

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staffmessaging messaging system for XSS...

Ocproducts Composr CMS 跨站脚本漏洞

Ocproducts Composr CMS is an open source content management system CMS written in PHP by ocProducts Ocproducts UK. A security vulnerability exists in ocProducts Composr CMS versions prior to 10.0.38, which can be exploited by attackers to inject JavaScript via Comcode...

PT-2021-22269

Name of the Vulnerable Software and Affected Versions ocProducts Composr CMS versions prior to 10.0.38 Description The issue allows an attacker to inject JavaScript via Comcode, resulting in a cross-site scripting XSS attack. This can potentially lead to unauthorized access or control of user...

CVE-2021-38708: Improper Neutralization of Input During Web Page Generation

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS...

CVE-2021-38709: Improper Neutralization of Input During Web Page Generation

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staffmessaging messaging system for XSS...

CVE-2021-37695

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 "Fake Objects" https://ckeditor.com/cke4/addon/fakeobjects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executin...

PT-2021-21576

Name of the Vulnerable Software and Affected Versions Flygo affected versions not specified Description The bulletin function does not filter special characters while a new announcement is added, allowing remote attackers to inject JavaScript and execute stored XSS attacks using a general user's...

CVE-2021-37211: Improper Neutralization of Input During Web Page Generation

The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks...

PT-2021-12165

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 5.0.0.0 through 5.0.8.11 Description This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

CVE-2021-32772

Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed, which allo...

PT-2021-21581

Name of the Vulnerable Software and Affected Versions QSAN Storage Manager affected versions not specified Description The issue concerns a lack of filtering for special characters in the QSAN Storage Manager header page parameters. This allows remote attackers to inject JavaScript without loggin...

IBM Jazz Foundation 跨站脚本漏洞

IBM Jazz Foundation is a next-generation collaboration platform for software delivery technologies from IBM. IBM Jazz Foundation has a cross-site scripting vulnerability that could allow a remote attacker to embed arbitrary JavaScript code in the Web UI to alter the intended functionality,...

CVE-2021-21442

In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19...

IBM Sterling B2B Integrator 跨站脚本漏洞

IBM Sterling B2B Integrator is a transaction engine, a set of components that run the processes you define and manage based on your business needs.IBM Sterling B2B Integrator is vulnerable to a cross-site scripting vulnerability that could be exploited by an attacker to embed arbitrary JavaScript...

CVE-2021-21442

In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19...

CVE-2021-37470

In NCH WebDictate v2.13, persistent Cross Site Scripting XSS exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript...

CVE-2021-26082

The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability...

Atlassian JIRA Server 跨站脚本漏洞

Atlassian JIRA Server is the server version of a defect tracking management system from Atlassian Australia. The system is mainly used for tracking and managing various types of problems and defects in work. A cross-site scripting vulnerability exists in Atlassian JIRA Server, which can be...