PT-2019-15286

Name of the Vulnerable Software and Affected Versions CoreHR Core Portal versions prior to 27.0.7 Description The issue allows for stored XSS, which can lead to malicious script execution. Recommendations For versions prior to 27.0.7, update to version 27.0.7 or later to resolve the issue...

WiKID Systems 2FA Enterprise Server Cross-Site Scripting Vulnerability (CNVD-2019-43367)

WiKID Systems 2FA Enterprise Server is a two-factor authentication server from WiKID Systems, USA. A cross-site scripting vulnerability exists in WiKID Systems 2FA Enterprise Server, which can be exploited by an attacker to inject malicious script or HTML code, which can be used to obtain sensiti...

Node.js third-party modules: Stored XSS (Hexo-admin plugin)

I would like to report Stored XSS in Hexo-admin It allows The Post editor functionality in the hexo-admin plugin 3.9.0 for Node.js is vulnerable to stored XSS via the content of a post. Module module name: Hexo-admin version: 3.9.0 npm page: https://www.npmjs.com/package/hexo-admin Module...

Cisco Unified Communications Manager WEB Interface Cross-Site Scripting Vulnerability

Cisco Unified Communications Manager is a unified communications solution. A cross-site scripting vulnerability exists in the Cisco Unified Communications Manager WEB interface, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used t...

PT-2019-14551

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2019.2.56595 Description A stored XSS issue was discovered on the issue page, which could potentially lead to malicious script execution. Recommendations For versions prior to 2019.2.56595, update to versio...

Cross-Site Scripting (XSS)

jspwiki-war is vulnerable to cross-site scripting XSS. The remember parameter in preview.jsp was not handled properly to escape malicious script injection, allowing to trigger the attack through it...

Cross-Site Scripting (XSS)

padrino-contrib is vulnerable to cross-site scripting XSS. The caption parameter in the function sethome of breadcrumbs.rb is not escaped properly to prevent injection of malicious script through it, allowing an attacker to steal session tokens or perform unwanted actions on behalf of the user...

Cross-site Scripting (XSS)

nodebb is vulnerable to cross-site scripting XSS. The attack exists because it does not have basic protection from XSS and relies on the plugins to perform sanitization of all the parsed content, allowing an attacker to inject malicious script if any of the plugins get disabled...

CVE-2019-4133: Undefined Security Weakness

IBM Cloud Automation Manager 3.1.2 could allow a malicious user on the client side with access to client computer to run a custom script. IBM X-Force ID: 158278...

Security Bulletin: IBM Cloud Automation Manager is affected by a insecure Content-Security-Policy header vulnerability CVE-2019-4133

Summary IBM Cloud Automation Manager could allow a malicious user on the client side with access to client computer to run a custom script. Vulnerability Details CVEID: CVE-2019-4133 DESCRIPTION: IBM Cloud Automation Manager could allow a malicious user on the client side with access to client...

Cross-site Scripting (XSS)

kevinpapst/kimai2 is vulnerable to cross-site scripting XSS. It does not escape the timesheet description, allowing an attacker to inject a malicious script via that description...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in transaction description field and in asset account name, allowing an attacker to inject malicious script in a convert transaction to get executed upon ...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data increate-from-bill name field, allowing an attacker to inject malicious script...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in liability name field, allowing an attacker to inject malicious script in a transaction to get executed upon an error condition during a visit to the...

Cross-site Scripting (XSS)

invenio-records is vulnerable to cross-site scripting XSS. When an admin user views a new record uploaded by a user with permission to upload in the admin interface, it directly renders JSON output for the new record, allowing the user to inject and render any arbitrary malicious script to render...

CVE-2019-14415: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. A persistent cross-site scripting XSS vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a resiliency plan that a...

CVE-2019-3414

All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...

Cross site scripting

All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...

CVE-2019-3414

All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack exists because it does not validate the file content provided by the user, allowing an attacker to inject a malicious script through it to get executed during viewing of attachments/view/$fileid$ attachment...