Remote Code Execution (RCE)

webkit2gtk is vulnerable to remote code execution. The vulnerability exists due to a memory corruption allowing an attacker to inject maliciously crafted script into the system...

NPM Library (ua-parser-js) Hijacked: What You Need to Know

Last Update: October 27, 2021 For approximately 4 hours on Friday, October 22, 2021, a widely utilized NPM package, ua-parser-js, was embedded with a malicious script intended to install a coinminer and harvest user/credential information. This package is used “to detect Browser, Engine, OS, CPU,...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2021-81105)

DedeCMS Dream Weaving Content Management System is a set of simple, robust, flexible, open source several characteristics of open source content management system. DedeCMS has a cross-site scripting vulnerability that can be exploited to inject malicious script code via the filename, mid, userid ...

Privilege Escalation

keycloak is vulnerable to privilege escalation. The realm management interface permits unauthorised setting up of scripts via the policy, allowing an attacker to inject and execute a malicious script with the permissions of the application user...

CVE-2021-25968

In “OpenCMS”, versions 10.5.0 to 11.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the Sitemap functionality. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field...

Cross-site Scripting (XSS) - Reflected in jspark311/buriedunderthenoisefloor

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execut...

Fortinet FortiWebManager Cross-Site Scripting Vulnerability

Fortinet FortiWebManager is a web application firewall from Fortinet, Inc. A cross-site scripting vulnerability exists in Fortinet FortiWebManager versions 6.2.3 and 6.0.2 and below, which stems from a lack of checksum filtering of user-supplied and output data, and can be exploited by attackers ...

CVE-2021-36175

FortiWebManager (Fortinet) is affected by CVE-2021-36175. The issue is an input handling flaw (CWE-79) that could allow an authenticated remote attacker to inject malicious script/tags through the name, description, or comments fields in several sections of FortiWebManager. Affected versions are ...

Remote Code Execution (RCE)

Redis is vulnerable to remote code execution. The vulnerability exists due to heap-based Lua stack to be overflowed. An attacker is able to crash the system by sending a maliciously crafted script to the system...

FortiWebManager - Injection vulnerabilities

An improper neutralization of input vulnerability CWE-79 in FortiWebManager may allow a remote authenticated attacker to inject malicious script/tags via the name/description/comments parameter of various sections of the device...

Cross-site Scripting (XSS)

datatables.net is vulnerable to cross-site scripting. An attacker is able to inject and execute malicious script as it does not sanitize an array passed to the HTML escape entities function...

Cross-site Scripting (XSS) - Generic in tsolucio/corebos

Description Generic XSS in RSS content allows for the arbitrary execution of JavaScript Proof of Concept // PoC Request Add RSS Feed POST /corebos/index.php?module=Rss&action=RssAjax&file=Popup&directmode=ajax&rssurl=http://127.0.0.1:9999/rss.xml HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0...

Cross-Site Scripting (XSS)

edge.js is vulnerable to cross-site scripting. A lack of validation of type when an attacker inputs an array regardless of the use of instead of a string allows an attacker to inject and execute malicious script...

Vulnerability discovered in Schneider Electric EcoStruxure Control Expert

A vulnerability has been discovered in Schneider Electric EcoStruxure Control Expert. The vulnerability could cause a malicious script to be deployed deployed to an unauthorized location which in turn could lead to the execution of code. Schneider Electric has published mitigating measures. More...

SAP Contact Center Cross-Site Scripting Vulnerability (CNVD-2025-02856)

SAP Contact Center is a new cloud service from SAP that is built on top of SAP's on-premise contact center software, putting modern contact center solutions at the agent's fingertips. A cross-site scripting vulnerability exists in SAP Contact Center 700. The vulnerability stems from the program n...

CVE-2021-33679

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence...

CVE-2021-33672

Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the...

Design/Logic Flaw

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence...

Design/Logic Flaw

Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the...

CVE-2021-33672

CVE-2021-33672 affects SAP Contact Center’s Communication Desktop component (v700). The vulnerability arises from missing encoding, allowing an attacker to send a malicious script in a chat message. Once the recipient accepts the message, the script executes in their context; due to ActiveX usage...