CVE-2019-3418

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability XSS. Due to incomplete input validation, an authorized user can exploit this vulnerability to execute malicious scripts...

Cross site scripting

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability XSS. Due to incomplete input validation, an authorized user can exploit this vulnerability to execute malicious scripts...

CVE-2019-9850

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on...

CVE-2019-1203

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

CVE-2019-0337: Improper Neutralization of Input During Web Page Generation

Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting XSS vulnerability...

CVE-2019-14415

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. A persistent cross-site scripting XSS vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a resiliency plan that a...

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting Exploit Title: Stored Cross Site Scripting XSS in Sitecore 9.0 rev 171002 Date: July 11, 2019 Exploit Author: Owais Mehtab Vendor Homepage: http://www.sitecore.net/en Version: 9.0 rev. 171002 Tested on: Sitecore Experience Platform 8.1...

PT-2019-7831

Name of the Vulnerable Software and Affected Versions F5 WebSafe Dashboard versions 3.9.x and earlier Description A Cross Site Scripting XSS issue allows an unauthenticated user to inject HTML via a crafted alert. This enables potential attackers to execute malicious scripts on the client-side...

CVE-2018-13375

An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in...

CVE-2018-13375

CVE-2018-13375 is an XSS-style vulnerability in Fortinet products where FortiAnalyzer 5.6.0 and earlier and FortiManager 5.6.0 and earlier fail to properly neutralize script-related HTML tags in the DHCP HOSTNAME parameter. An attacker can inject malicious scripts via a DHCP request, and the scri...

CVE-2018-13375

An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in...

PT-2019-6084

Name of the Vulnerable Software and Affected Versions FortiManager versions 5.6.0 and below FortiAnalyzer versions 5.6.0 and below Description The issue is related to the failure to protect the web page structure, allowing an attacker to redirect users to a malicious web page. An improper...

PT-2019-8581

Name of the Vulnerable Software and Affected Versions Open-Xchange GmbH OX App Suite versions 7.8.3 and earlier Description The issue is related to Cross Site Scripting XSS, which is a type of security vulnerability that can allow an attacker to inject malicious scripts into a website...

Node.js third-party modules: [min-http-server] Stored XSS in the filename when directories listing

I would like to report Stored XSS in module "min-http-server". It allows to inject malicious scripts in the file name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module module name: min-http-server version: 1.0.6 npm page:...

Node.js third-party modules: [http-file-server] Stored XSS in the filename when directories listing

I would like to report Stored XSS in module "http-file-server". It allows to inject malicious scripts in the file name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module module name: http-file-server version: 0.2.6 npm page:...

PT-2019-11991

Name of the Vulnerable Software and Affected Versions Heidelberg Prinect Archiver version 2013 release 1.0 Prinect Archive System 2015 Release 2.6 Description A Reflected Cross Site Scripting XSS issue was discovered. This issue allows for the execution of malicious scripts in the context of the...

TomTom: Reflected Cross Site Scripting vuln in tomtom.com

Hello Tomtom security team I found a reflected cross site scripting security vulnerability in tomtom.com https://www.tomtom.com/nlnl/search/?q=27%22--%3E%3CDetails%20Open%20OnToggle=confirmdocument.domain%3E This payload when loaded displays the domain the XSS vulnerability occurs in www.tomtom.c...

PT-2019-9944

Name of the Vulnerable Software and Affected Versions Microweber version 1.0.8 Description The issue is related to reflected cross-site scripting XSS, which can potentially allow attackers to inject malicious scripts into websites. Recommendations For Microweber version 1.0.8, at the moment, ther...

Ad Network Sizmek Probes Account Breach

Online advertising firm Sizmek Inc. NASDAQ: SZMK says it is investigating a security incident in which a hacker was reselling access to a user account with the ability to modify ads and analytics for a number of big-name advertisers. In a recent posting to a Russian-language cybercrime forum, an...

SQL Injection

phpmyadmin is vulnerable to SQL injection. The vulnerability is possible because it allows the attacker to inject malicious SQL scripts via the username in the designer feature...