CVE-2020-28210

A CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser...

CVE-2020-25702

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10...

CVE-2020-25702

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10...

CVE-2020-25702

CVE-2020-25702 affects Moodle: JavaScript can be included when renaming content bank items in versions 3.9 through 3.9.2. The issue is addressed in Moodle 3.9.3 and Moodle 3.10. The CVE is documented with two metrics: CVSS2 (4.3, MEDIUM) and CVSS3.1 (6.1, MEDIUM). The vulnerability arises from th...

CVE-2020-25702

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10...

CVE-2020-25702: Improper Neutralization of Input During Web Page Generation

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10...

PT-2020-18217

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service versions 6.0.6 through 7.0.1 Description This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a truste...

CVE-2020-28210: Improper Neutralization of Input During Web Page Generation

A CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser...

CVE-2020-4718

IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2020-28129

Stored Cross-site scripting XSS vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'...

SourceCodester Online Clothing Store Cross-Site Script Vulnerabilities

SourceCodester Online Clothing Store is a website builder system from SourceCodester, Inc. that provides online clothing store functionality. A cross-site scripting vulnerability exists in SourceCodester Online Clothing Store version 1.0, which originates from the vulnerability is via an Offer...

Cross-Site Scripting (XSS)

jinja2 is vulnerable to Cross Site Scripting. An attacker is able to inject and execute arbitrary Javascript through the gettext and ngettext function due to the lack of output sanitization...

Zimbra Collaboration Server < 8.8.15 P11 / 9.x < 9.0.0 P4 XSS

According to its self-reported version number, Zimbra Collaboration Server is below 8.8.15 Patch 11, or 9.x prior to 9.0.0 Patch 4. It is, therefore, affected by a cross-site scripting XSS vulnerability in the Webmail component. An unauthenticated, remote attacker can exploit this, by convincing ...

CVE-2020-13954: Improper Neutralization of Input During Web Page Generation

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This...

IBM Content Navigator Cross-Site Scripting Vulnerability (CNVD-2020-62468)

IBM Content Navigator is a Web client that provides users with a console that enables them to access, manage, and use corporate content anytime, anywhere, from any location in the organization on virtually any mobile device. A stored cross-site scripting vulnerability exists in IBM Content...

CVE-2020-4760

IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188737...

Joplin Desktop Cross-Site Scripting Vulnerability

Joplin is an open source notes and to-do list application. A cross-site scripting vulnerability exists in Joplin Desktop version 1.2.6, which stems from the lack of proper validation of client-side data via a link in a note, and can be exploited by an attacker to inject JavaScript code into the...

Cross-site Scripting (XSS)

dompurify is vulnerable to Cross-Site ScriptingXSS. The vulnerability exists when converting from the SVG namespace, allowing an attacker to inject and execute arbitrary Javascript...

jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method

A Cross-site scripting XSS vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the ‘HTML’ function to inject Javascript into the page where that input is rendered, and have it delivered by the browser...

jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method

A Cross-site scripting XSS vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the ‘HTML’ function to inject Javascript into the page where that input is rendered, and have it delivered by the browser...