PT-2020-15236

Name of the Vulnerable Software and Affected Versions Flexmonster Pivot Table & Charts version 2.7.17 Description The issue is related to a Cross Site Scripting XSS vulnerability in the Remote JSON component under the Connect menu. This vulnerability can be exploited to execute malicious scripts ...

PT-2020-15235

Name of the Vulnerable Software and Affected Versions CMS Made Simple CMSMS version 2.2.4 Description A Cross Site Scripting XSS issue exists in the Showtime2 Slideshow module. This allows for potential malicious script execution. Recommendations For CMS Made Simple CMSMS version 2.2.4, update th...

Vulnerability fixed in Dell iDRAC

Dell has fixed a vulnerability in iDrac. A malicious person could exploit the vulnerability to perform a Cross-Site Scripting XSS attack. Such an attack can lead to the execution of arbitrary script code in the browser used to visit the application is visited. iDRAC is a management environment. I...

PT-2020-15240

Name of the Vulnerable Software and Affected Versions Flexmonster Pivot Table & Charts version 2.7.17 Description The issue is related to a Cross Site Scripting XSS vulnerability in the "To Remote CSV" component under the "Open" Menu. This vulnerability allows for malicious script execution...

PT-2020-15239

Name of the Vulnerable Software and Affected Versions Flexmonster Pivot Table & Charts version 2.7.17 Description A Cross Site Scripting XSS issue exists in the To OLAP XMLA component under the Connect menu. This allows for potential malicious script execution. No information is provided about th...

DELL Dell EMC iDRAC9 Cross-Site Scripting Vulnerability

DELL Dell EMC iDRAC9 is a system management solution comprising hardware and software from Dell USA. The solution provides remote management, crash system recovery and power control for Dell PowerEdge systems. A cross-site scripting vulnerability exists in the Dell EMC iDRAC9 version 4.32.10.00 a...

CVE-2020-26828

SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type. In some file types it is possible to enter formulas which can call external applications or execute scripts. The execution of a payload script on target...

CVE-2020-26828

SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type. In some file types it is possible to enter formulas which can call external applications or execute scripts. The execution of a payload script on target...

CVE-2020-26958

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

Design/Logic Flaw

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

CVE-2020-26958

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

CVE-2020-26828: Unrestricted Upload of File with Dangerous Type

SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type. In some file types it is possible to enter formulas which can call external applications or execute scripts. The execution of a payload script on target...

desknet's NEO vulnerable to cross-site scripting

Overview desknet's NEO provided by NEOJAPAN Inc. contains a stored cross-site scripting vulnerability CWE-79. Ryo Sato of BroadBand Security,Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary...

PT-2020-20518

Name of the Vulnerable Software and Affected Versions CloudEngine 12800 affected versions not specified CloudEngine 5800 affected versions not specified CloudEngine 6800 affected versions not specified CloudEngine 7800 affected versions not specified Description The issue is related to a privileg...

PT-2020-6785

Name of the Vulnerable Software and Affected Versions FortiGate versions 6.2.x through 6.2.4 FortiGate versions 6.4.x through 6.4.0 Description The issue is related to an improper neutralization of input, which may allow a remote attacker to perform a stored cross-site scripting attack XSS via th...

Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

[SECURITY] Fedora 32 Update: pacemaker-2.0.5-0.7.rc3.fc32

Pacemaker is an advanced, scalable High-Availability cluster resource manager. It supports more than 16 node clusters with significant capabilities for managing resources and dependencies. It will run scripts at initialization, when machines go up or down, when related resources fail and can be...

Movable Type Premium vulnerable to cross-site scripting

Overview Movable Type Premium provided by Six Apart Ltd. contains a cross-site scripting vulnerability CWE-79. Six Apart Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Six Apart Ltd. coordinated under the Information Security Early Warning...

KonaWiki Cross-Site Scripting Vulnerabilities

KonaWiki3 is a very simple PHP Wiki engine.KonaWiki3 is vulnerable to cross-site scripting. An attacker can exploit this vulnerability to execute arbitrary scripts on a user's Web browser via specially crafted URLs...