Bloomreach Experience Manager 跨站脚本漏洞

Bloomreach Experience Manager is an application from Bloomreach USA. which provides AI-driven search and merchandising tools. A cross-site scripting vulnerability exists in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2, which stems from the loginmessage parameter allowing XSS in the log...

CVE-2020-14988: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the...

CVE-2019-13237

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, groupnew.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp...

CVE-2014-7277: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00AADY.4C0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified "welcome message" form data that is improperly handled during rendering of the...

CVE-2006-2891: Undefined Security Weakness

Cross-site scripting XSS vulnerability in admin/index.php for Pixelpost 1-5rc1-2 and earlier allows remote attackers to inject arbitrary HTML or web script via the loginmessage parameter...