PT-2021-20869

Name of the Vulnerable Software and Affected Versions: MaxSite CMS versions prior to V106 Description: A reflected cross-site scripting XSS issue allows remote attackers to inject arbitrary web script to a page via the "product/page/" API endpoint. This enables attackers to execute malicious...

Cybozu Garoon Cross-Site Scripting Vulnerability

Cybozu Garoon is a portal-based OA office system from Cybozu Japan. A cross-site scripting vulnerability exists in some of the email functions in Cybozu Garoon. An attacker can use this vulnerability to execute arbitrary scripts on a logged-in user's Web browser...

Cybozu Garoon Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Bulletin in Cybozu Garoon, a portal-based OA office system from Cybozu Japan. An attacker can use this vulnerability to execute arbitrary scripts on a logged-in user's Web browser...

CVE-2020-20699

A cross site scripting XSS vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Copyright text box under Basic Settings...

PT-2021-10690

Name of the Vulnerable Software and Affected Versions: WDScanner version 1.1 Description: A Cross Site Scripting issue exists in the system management page, which may allow for malicious script execution. Recommendations: For WDScanner version 1.1, update to a newer version that contains a fix fo...

Vulnerability fixed in CheckMK

A vulnerability has been fixed in CheckMK. A malicious party can exploit the vulnerability to perform a Cross-Site Scripting XSS attack. Such an attack can lead to the execution of arbitrary script code in the browser used to visit the application is visited. CheckMK has released updates to fix t...

Cross-site Scripting (XSS) - Reflected in dolibarr/dolibarr

Description Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off of a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious...

PT-2021-21661

Name of the Vulnerable Software and Affected Versions NCH IVM Attendant versions 5.12 and earlier Description Cross Site Scripting XSS exists in the software via the Mailbox name stored. This issue allows for the execution of malicious scripts. Recommendations For versions 5.12 and earlier, updat...

PT-2021-21677

Name of the Vulnerable Software and Affected Versions NCH Axon PBX versions 2.22 and earlier Description A Cross Site Scripting XSS issue exists, allowing for reflected XSS attacks via the /ipblacklist?errorip= endpoint. This can potentially lead to malicious script execution. Recommendations For...

Shopify: Stored XSS in SVG file as data: url

A stored XSS vulnerability was discovered in Shopify's rich text editor on July 24, 2021. Attackers were able to insert an XSS payload encoded in an SVG file using data: URLs. The vulnerability was fixed by preventing the conversion of data: URLs into blob: URLs...

Tecnick.com TCExam Cross-Site Script Vulnerabilities

Tecnick.com TCExam is a Web-based open source e-exam system from Tecnick.com, UK. The system is primarily used for online exams and more. TCExam suffers from a cross-site scripting vulnerability that stems from insufficient validation of user-supplied data in tceselectmediafile.php. A remotely...

PT-2021-19901

Name of the Vulnerable Software and Affected Versions Collabora Online versions prior to 6.4.9-5 Description A reflected XSS issue was found in Collabora Online, allowing an attacker to inject unescaped HTML into a variable as they created the Collabora Online iframe. This could execute scripts...

Collabora Online: Cross-site Scripting Vulnerabilities

Collabora Online is an application from Collabora. A powerful LibreOffice-based online office that supports all major document, spreadsheet and presentation file formats. A cross-site scripting vulnerability exists in Collabora Online versions prior to 6.4.9-5. The vulnerability allows an attacke...

JVN#86026700: Multiple vulnerabilities in GroupSession

GroupSession provided by Japan Total System Co.,Ltd. contains multiple vulnerabilities listed below. Cross-site scripting vulnerability CWE-79 - CVE-2021-20785 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2|...

moziloCMS Stored Cross-Site Scripting Vulnerability

moziloCMS is open source a content management system CMS. A security vulnerability exists in moziloCMS, which can be exploited by an attacker to execute arbitrary web script or HTML through a specially crafted load by entering the "Content" parameter...

CSZ CMS Cross-Site Scripting Vulnerability (CNVD-2021-50173)

CSZ CMS is a PHP-based open source content management system CMS. CSZ CMS suffers from a cross-site scripting vulnerability that can be exploited to execute arbitrary web script or HTML via a specially crafted load entered in the "New Article" field under the "Article" plugin...

Codoforum cross-site scripting vulnerability (CNVD-2021-50176)

Codoforum is a set of PHP and MySQL based forum software. A cross-site scripting vulnerability exists in Codoforum version 5.0.2, which can be exploited by an attacker to execute arbitrary web script or HTML via a crafted payload with the "Smiley Code" parameter...

dotCMS Cross-Site Scripting Vulnerability (CNVD-2021-50940)

dotcms is a powerful Content Management System CMS developed in Java. A stored cross-site scripting vulnerability exists in dotCMS version 21.05.1 in dotAdmin//c/cImages, which can be exploited by an attacker to execute arbitrary Web script or HTML via the 'Title' and 'Filename' parameters...

Vulnerabilities fixed in IBM Tivoli Netcool/OMNIbus

IBM has fixed vulnerabilities in the web interface of Tivoli Netcool/OMNIbus. An authenticated malicious person can exploit the exploit the vulnerabilities to perform a Cross-Site Scripting XSS attack. Such an attack can result in the execution of arbitrary script code in the browser used to visi...

CVE-2020-35987

A stored cross site scripting XSS vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter...