CVE-2020-13628

CVE-2020-13628 is a cross-site scripting (XSS) vulnerability in Centreon’s web widgets. The flaw allows remote attackers to inject arbitrary script or HTML via the widgetId parameter in host-monitoring/src/toolbar.php. Affected components and fixes are documented across multiple Centreon widgets:...

CVE-2020-12706

The CVE-2020-12706 issue affects PHP-Fusion 9.03.50, where multiple stored Cross-site Scripting vulnerabilities exist in the FAQ admin and shoutbox admin paths (faq/faq_admin.php and shoutbox_panel/shoutbox_admin.php) via the go parameter. Attackers can inject arbitrary scripts to the affected pa...

IBM Tivoli Netcool Impact Cross-Site Scripting Vulnerability (CNVD-2020-19258)

IBM Tivoli Netcool Impact is a suite of network management software from IBM in the United States. The software has the ability to automate business-critical functions and provide a platform that provides unified access to real-time data, events and indicators. A cross-site scripting vulnerabilit...

CVE-2019-13463

CVE-2019-13463 describes an XSS vulnerability in the WordPress plugin Simple Link Directory (qcopd-shortcode-generator.php) prior to version 7.3.5. The root cause is that esc_html is not applied to the output statements, specifically echo get_the_title() and echo $term->name , allowing remote ...

Electronic Arts Origin Client Remote Code Injection (CVE-2019-11354)

A template injection vulnerability exists in the Electronic Arts Origin Client. The vulnerability is due to improper validation of data in the title parameter. Successful exploitation could result in command execution on the target machine in the context of the application...

CVE-2014-9606

Netsweeper CVE-2014-9606 involves multiple XSS vulnerabilities in Netsweeper releases: 3.1.10 and older 4.0.x (before 4.0.9) and 4.1.x (before 4.1.2). The XSS can be triggered by specially crafted inputs in five vectors: (1) server parameter to remotereporter/load_logfiles.php, (2) customctid to ...

Cisco Jabber Guest WEB Interface Cross-Site Scripting Vulnerability

Cisco Jabber Guest is a consumer-to-business C2B solution. A cross-site scripting vulnerability exists in the Cisco Jabber Guest WEB interface, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtain sensitive information or hijack user sessio...

CVE-2013-3565

Multiple cross-site scripting XSS vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 command parameter to requests/vlmcmd.xml, 2 dir parameter to requests/browse.xml, or 3 URI in a request, which ...

CVE-2013-3322

CVE-2013-3322 affects NetApp OnCommand System Manager (versions <= 2.1 and

Huawei EulerOS: Security Advisory for mutt (EulerOS-SA-2018-1305)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-1607

CVE-2020-1607 is a Junos OS/J-Web cross-site scripting vulnerability. The root cause is insufficient XSS protection in J-Web, allowing a remote attacker to inject scripts or HTML to hijack an authenticated user’s J-Web session and perform admin actions. Affected software ranges are extensive, inc...

Code injection

The web interface on the Technicolor TC7230 STEB 01.25 is vulnerable to DNS rebinding, which allows a remote attacker to configure the cable modem via JavaScript in a victim's browser. The attacker can then configure the cable modem to port forward the modem's internal TELNET server, allowing...

CVE-2019-15979

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system OS. For more information about...

Code injection

Bulb Security Smartphone Pentest Framework SPF before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to 1 remoteAttack.pl or 2 guessPassword.pl in frameworkgui/; the filename parameter to 3 CSAttack.pl or 4 SEAttack.pl in...

CVE-2013-7351

Multiple cross-site scripting XSS vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary web script or HTML via the URL to the 1 showRSS, 2 showATOM, or 3 showDailyRSS function; a 4 file name to the importFile function; or 5 vectors related to bookmarks...

CVE-2013-4752

The CVE-2013-4752 issue affects Symfony’s HttpFoundation component across Symfony 2.0.x up to 2.0.24, 2.1.x up to 2.1.12, 2.2.x up to 2.2.5, and 2.3.x up to 2.3.3. The vulnerability arises because the Host header can be manipulated when the framework generates an absolute URL, enabling a remote a...

CVE-2013-4752

Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to...

Code injection

The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message...

CVE-2013-0202

Cross-site scripting XSS vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to core/ajax/sharing.php...

CVE-2019-19830

CVE-2019-19830 affects SPIP 3.2.x before 3.2.7, where the medias plugin (core /plugins/medias) allows a remote authenticated author to inject content into the database due to the underlying vulnerability in the media handling. The issue is a database injection risk that can impact data integrity....