Cross-site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. The vulnerability exists as the URLs were not correctly filtered in some cases, allowing an attacker to inject malicious script...

Cross-site Scripting (XSS)

productscmfcore, productspluggableauthservice and plone are vulnerable to cross-site scripting. An attacker is able to inject malicious script through unsanitized user-provided arguments...

PT-2021-17694

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions prior to 6104 Description: The issue allows stored XSS on the "/webclient/index.html/directory-search" user search page via the e-mail address field. This could potentially lead to malicious scrip...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting. An attacker is able to inject malicious script in Mustache helper tags included in the Mustache templates via recursive rendering from contexts...

PT-2021-19587

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2020.2.3 Description: The issue allows for reflected XSS on several pages, which can lead to malicious script execution. Recommendations: For versions prior to 2020.2.3, update to version 2020.2.3 or later...

PT-2021-19583

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2020.2.3 Description: The issue allows for stored XSS on several pages, which can lead to malicious script execution. Recommendations: For versions prior to 2020.2.3, update to version 2020.2.3 or later to...

PT-2021-20056

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2020.2.2 Description The issue allows for stored XSS on a tests page, which could potentially lead to malicious script execution. Recommendations For versions prior to 2020.2.2, update to version 2020.2.2 o...

MTN Group: Cross-Site Request Forgery (CSRF) to xss

hello dear support i have found csrf to xss on https://dailydeals.mtn.co.za/index.cfm?GO=DEALS URL:https://dailydeals.mtn.co.za/index.cfm?GO=DEALS URL encoded POST input CFID was set to fbe8c86c-c0b2-4421-8ca2-dcfc14763d6e" HTTP request ============ POST /index.cfm?GO=DEALS HTTP/1.1 Host:...

PT-2021-14592

Name of the Vulnerable Software and Affected Versions Dell EMC iDRAC9 versions prior to 4.40.10.00 Description The issue allows a remote authenticated malicious user with high privileges to store malicious HTML or JavaScript code through multiple affected areas while generating a certificate. Whe...

HackerOne: Stored XSS in IE11 on hackerone.com via custom fields

Hi There, i found stored xss via Custom Fields F1275694 ---------------------------------- F1275691 POC: F1275692 Impact The attacker can use this issue to execute malicious script code in the victim user browser also redirect the victim user to malicious sites...

Cross-site Scripting (XSS)

gwtupload is vulnerable to cross-site scripting. An attacker is able to inject and execute malicious script in a user's browser via the name parameter of file upload functionality...

MacOSX: Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution (cisco-sa-anyconnect-ipc-KfQO9QhK)

According to its self-reported version, Cisco AnyConnect Secure Mobility Client is affected by a arbitrary code execution vulnerability. The vulnerability is due to a lack of authentication to the IPC listener. An authenticated, local attacker could exploit this vulnerability by sending crafted I...

Cross-site Scripting (XSS)

Synapse is vulnerable to cross-site scripting XSS attacks. An attacker is able to inject and execute malicious script as the library does not escape loading of HTML files from the default Synapse template directory, allowing access to cookies and other browser data and access to other resources...

Cross-site Scripting (XSS)

typo3/cms-backend is vulnerable to cross-site scripting. An authenticated malicious user is able to inject and execute malicious script via the descriptionColumn when their content gets previewed...

Zen Cart Cross-Site Scripting Vulnerability (CNVD-2021-22861)

Zen Cart is open source, free mall system for building professional online stores. A reflective cross-site scripting vulnerability exists in Zen Cart 1.5.6d. An attacker can execute malicious script via the includes/templates/templatedefault/common/tplmainpage.php or...

Cross-site Scripting (XSS)

velocity-tools-view is vulnerable cross-site scripting XSS. An attacker is able to inject and execute malicious script in a user's browser as it does not escape a user-provided vm file as part of the URL which displayed in the error page...

CVE-2021-23974

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox 86...

PT-2021-9009

Name of the Vulnerable Software and Affected Versions Micro Focus Solutions Business Manager versions prior to 11.7.1 Description The issue concerns stored XSS, where the application reflects previously stored user input without encoding. This allows for potential malicious script execution...

Remote Code Execution (RCE)

moodle/moodle is vulnerable to remote code execution. The vulnerability exists because a malicious admin user can inject and execute a malicious script via a PHP include used during Shibboleth authentication...

The vulnerability in the loading of Mozilla Firefox browser extensions allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of Mozilla Firefox browser extensions relates to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information by loading a specially created script...