PT-2019-15228

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue is related to a security problem where an attacker can execute malicious scripts. This is achieved by exploiting the dbname parameter in the "install/index.php" endpoint. Recommendations For HongCMS...

Intelbras Router WRN150 Cross-Site Scripting Vulnerability

The Intelbras Router WRN150 is a wireless router from Intelbras Brazil. A cross-site scripting vulnerability exists in the Intelbras Router WRN150. An attacker can exploit the vulnerability to execute arbitrary script code in the context of the affected site. This allows an attacker to steal...

Adobe Experience Manager APSB19-48 Multiple Security Vulnerabilities

Description Adobe Experience Manager is prone to multiple security vulnerabilities. Attackers can exploit these issues to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials, to gain access to sensitive...

keycloak: script execution via realm management policy trigger

A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the...

bootstrap: XSS in the affix configuration target property

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the affix configuration target property. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hostin...

bootstrap: XSS in the tooltip data-viewport attribute

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting, caused by improper validation of user-supplied input by the tooltip data-viewport attribute. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hosting W...

PT-2019-15167

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge aka jnoj version 0.8.0 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the Problemdescription parameter. Th...

Microsoft Dynamics 365 Cross-Site Scripting Vulnerability (CNVD-2019-35573)

Microsoft Dynamics 365 is a suite of ERP business solutions for multinational organizations from Microsoft USA. The product includes financial management, production management and business intelligence management. A cross-site scripting vulnerability in Microsoft Dynamics 365 on-premises version...

PT-2019-15108

Name of the Vulnerable Software and Affected Versions S-CMS version 1.5 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved by exploiting the member login.php parameter in the tpl.php file. Recommendations For S-CMS version 1.5,...

SAP BusinessObjects Business Intelligence Reflective Cross-Site Scripting Vulnerability (CNVD-2019-34409)

SAP BusinessObjects Business Intelligence is a reporting and analytics business intelligence BI platform for enterprise users. A reflected cross-site scripting vulnerability exists in SAP BusinessObjects Business Intelligence versions prior to 4.2 and 4.3. The vulnerability stems from the product...

Subrion cross-site scripting vulnerability (CNVD-2019-44570)

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. A cross-site scripting vulnerability exists in Subrion version 4.2.1, which can be exploited by an attacker to execute...

CVE-2019-17206

Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper aka Redis Wrapper before 0.3.0 allows attackers to execute arbitrary scripts...

CVE-2019-17206

Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper aka Redis Wrapper before 0.3.0 allows attackers to execute arbitrary scripts...

CVE-2019-17206: Deserialization of Untrusted Data

Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper aka Redis Wrapper before 0.3.0 allows attackers to execute arbitrary scripts...

PT-2019-20134

Name of the Vulnerable Software and Affected Versions Frost Ming rediswrapper aka Redis Wrapper versions prior to 0.3.0 Description The issue is related to uncontrolled deserialization of a pickled object in models.py, which allows attackers to execute arbitrary scripts. Recommendations For...

File Containment Vulnerability in Website Building System of Beijing Zhengmeng Network Technology Co.

Beijing positive amount of network technology limited company positive amount of network, is based on cloud computing enterprise electronic bidding and procurement and supply chain cooperative management overall solution provider. Beijing positive amount of network technology limited company...

LibreOffice < 6.2.7 / 6.3.x < 6.3.1 Multiple Vulnerabilities (Windows)

The version of LibreOffice installed on the remote Windows host is prior to 6.2.7 or 6.3.x prior to 6.3.1. It is, therefore, affected by the following vulnerabilities: - A directory traversal vulnerability resulting from a feature in LibreOffice which allows documents to specify pre-installed...

CVE-2019-12707

A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient...

PT-2019-3804

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine affected versions not specified Description The issue is related to insufficient protection of the web page structure in the Cisco Identity Services Engine management interface, allowing for potential cross-site...

PT-2019-14551

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2019.2.56595 Description A stored XSS issue was discovered on the issue page, which could potentially lead to malicious script execution. Recommendations For versions prior to 2019.2.56595, update to versio...