PT-2021-20939

Name of the Vulnerable Software and Affected Versions: TIBCO Nimbus versions 10.4.0 and below Description: The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting XSS vulnerabilities. These vulnerabilities allow a low privileged...

CVE-2020-20908: Improper Neutralization of Input During Web Page Generation

Akaunting v1.3.17 was discovered to contain a stored cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Company Name input field...

Rocket.Chat: XSS in various MessageTypes

The Rocket.Chat vulnerability allowed arbitrary script execution in the receiving frontend client through the rendering of messages of various MessageTypes. The vulnerability affected versions 3.18.2 and 4.0.3. The issue was caused by the lack of sanitization of message parameters rendered from...

CVE-2020-36499

TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a cross-site scripting XSS vulnerability in the content parameter of the Rubric Block Add module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the rubric name value...

CVE-2020-23041

Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting XSS vulnerability in the path parameter of the list and download exception-handling. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request...

Cross site scripting

Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting XSS vulnerability in the devicename parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the devicename information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields...

SugarCRM Cross-site Scripting Vulnerability

Sugarcrm SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM Sugarcrm, USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and information sharing and tracking of sales representatives. SugarC...

PT-2021-11611

Name of the Vulnerable Software and Affected Versions: Perfex CRM version 2.4.4 Description: A stored cross-site scripting XSS issue was found in the ./clients/client component of Perfex CRM, specifically via the company name parameter. This allows for malicious script execution when the paramete...

Fork CMS cross-site scripting vulnerabilities

Fork CMS is an open source content management system CMS developed using PHP. The system contains blogs , questions and answers , forms and other modules . A cross-site scripting vulnerability exists in Fork CMS Content Management System version 5.8.0, which can be exploited by an attacker to...

Portable Ltd Playable: Code Injection Vulnerability

Portable Ltd Playable is a Full HD media player for Pc from Portable Ltd, UK. Portable Ltd Playable suffers from a code injection vulnerability that stems from Portable Ltd Playable v9.18 containing a code injection vulnerability in the filename parameter. An attacker could use this vulnerability...

Privilege Defined With Unsafe Actions in Keycloak

A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the...

PT-2021-16893

Name of the Vulnerable Software and Affected Versions Camaleon CMS versions 0.0.1 through 2.6.0 Description The issue allows an unauthenticated attacker or unprivileged application users to store malicious scripts in the comments section of a post. These scripts are executed in a victim's browser...

PT-2021-8345

Name of the Vulnerable Software and Affected Versions Rails versions prior to 3.0.6 Description A cross-site scripting issue was found in the auto link function. This affects the ability to properly handle user input, potentially leading to malicious script execution. Recommendations For versions...

Cross-site Scripting (XSS) - Stored in osticket/osticket

Description As it is written on github profile, osTicket is a widely-used open source support ticket system. During source code research I discovered bad uploaded file type check, which is controlled by user. Unauthenticated user can upload malicious html/js file. FROM OWASP:: Cross-Site Scriptin...

DEBIAN-CVE-2021-42013

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default...

CVE-2020-21729: Improper Neutralization of Input During Web Page Generation

JEECMS x1.1 contains a stored cross-site scripting XSS vulnerability in the component of /member-vipcenter.htm, which allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

PT-2021-15569

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue allows an attacker to potentially execute scripts on a client's computer by sending a manipulated URL, exploiting a reflected XSS weakness in the web server. Recommendations: ...

Xiuno BBS Cross-Site Scripting Vulnerability

Xiuno BBS is an open source forum program based on PHP and MySQL. Xiuno BBS suffers from a cross-site scripting vulnerability that originates from the failure of the product/admin/?setting-base.htm page to properly handle data in the sitename field. An attacker can execute client-side code via th...

PT-2021-18098

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS affected versions not specified Description: A stored cross-site scripting XSS issue may allow a remote unauthenticated attacker to pass and store malicious strings in the home application. This could potentially lead t...