cxf: reflected XSS in the services listing page

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploit...

cxf: reflected XSS in the services listing page

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploit...

CVE-2020-5592: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Zenphoto versions prior to 1.5.7 allows remote attackers to inject an arbitrary JavaScript via unspecified vectors...

IBM Workload Scheduler Cross-Site Scripting Vulnerability

IBM Workload Scheduler is a suite of enterprise task scheduling software from IBM in the United States. The software automates the control of workloads. A cross-site scripting vulnerability exists in IBM Workload Scheduler 9.3.0.4 and earlier versions. An attacker can exploit this vulnerability t...

Prevent JavaScript injection in Operations Manager 2016 web console

Prevent JavaScript injection in Operations Manager 2016 web console Problem description Missing input validation and output encoding allows JavaScript injection, leading to Reflected Cross Site Scripting XSS. Reflected Cross Site Scripting may be used to inject arbitrary JavaScript to the Microso...

PT-2020-17902

Name of the Vulnerable Software and Affected Versions IBM Security Guardium version 11.1 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2020-17901

Name of the Vulnerable Software and Affected Versions IBM Security Guardium version 11.1 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session...

IBM Planning Analytics Cross-Site Scripting Vulnerability (CNVD-2020-32654)

IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. A cross-site scripting vulnerability exists in IBM Planning Analytics. An attacker can exploit thi...

PT-2020-18103

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local version 2.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2020-18029

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local version 2.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2020-18024

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local version 2.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

CVE-2020-4021

Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the XML export view...

CVE-2020-4023

The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting XSS vulnerability through the committerFilter parameter...

CVE-2020-4021

Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the XML export view...

CVE-2020-4013: Improper Neutralization of Input During Web Page Generation

The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting XSS vulnerability through the review objectives...

PT-2020-17827

Name of the Vulnerable Software and Affected Versions Atlassian Fisheye and Crucible versions prior to 4.8.1 Description The issue allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting XSS vulnerability through the review objectives. This can be exploited by...

PT-2020-17835

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.5.5 Atlassian Jira Server and Data Center versions 8.6.0 through 8.8.0 Description The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XS...

cxf: reflected XSS in the services listing page

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploit...

jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method

A Cross-site scripting XSS vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the ‘HTML’ function to inject Javascript into the page where that input is rendered, and have it delivered by the browser...

CVE-2020-13644

An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wpajaxaccordionsajaximportjson action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordio...