GHSA-Q6W2-89HQ-HQ27 keycloak Self Stored Cross-site Scripting vulnerability

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability ...

CVE-2021-20195

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability ...

CVE-2021-20195

Summary (CVE-2021-20195) : A Self Stored XSS in Keycloak prior to 13.0.0 allows an attacker to escalate to account takeover by abusing unencoded user-supplied fields processed by JavaScript. Reported impact includes potential compromise of data confidentiality, integrity, and system availability....

CVE-2021-20195

A flaw was found in keycloak. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality...

U.S. Dept Of Defense: Self stored Xss + Login Csrf

Description: User can set username between 8-20 alphanumeric characters, but with the help of inspect element attacker can manipulate ██████= & can insert a xss payload resulting in self stored xss & with the help of login csrf attacker can force the victim into attacker's account causing...

Design/Logic Flaw

cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface SEC-527...

CVE-2019-17379

CVE-2019-17379 affects cPanel before 82.0.15, introducing a self-stored XSS in the WHM SSL Storage Manager interface. The underlying issue is lack of proper validation of client-side data in the web application, enabling an attacker to inject and execute script through stored input. Impact per so...

Cross site scripting

cPanel before 60.0.25 allows self stored XSS in SSLlistkeys SEC-182...

CVE-2016-10783

CVE-2016-10783 affects cPanel before 60.0.25, where a self‑stored XSS is possible in SSL_listkeys due to insufficient validation in the web application. The vulnerability allows attacker‑controlled data to be stored and later reflected in the client, enabling cross‑site scripting. Affected produc...

CVE-2016-10782

CVE-2016-10782 affects cPanel versions prior to 60.0.25, with a self-stored XSS in the postgres API1 listdbs. The root cause is insufficient validation of client-side data in the web application, allowing injected scripts to run when listing databases. Impact: stored XSS in affected user sessions...

CVE-2016-10778

CVE-2016-10778 affects cPanel before 60.0.25, with a stored XSS in the listftpstable API (SEC-178). The root cause cited is lack of proper validation of client data, enabling attacker-controlled scripts to execute in the victim’s browser. Consequences described are client-side code execution; no ...

Cross site scripting

cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences SEC-96...

Cross site scripting

cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer SEC-386...

CVE-2016-10827

CVE-2016-10827 : A stored XSS vulnerability in cPanel/WHM (Edit System Mail Preferences) affects versions before 55.9999.141. The issue is described as a self-stored cross-site scripting flaw that could be exploited through the affected mail preferences UI. Public references in the connected docu...

CVE-2018-20950

CVE-2018-20950 affects cPanel before version 68.0.27, allowing a self-stored XSS in WHM Account Transfer (SEC-386). The vulnerability stems from insufficient input validation in the transfer workflow, enabling an attacker to inject and execute client-side script. Impact is limited to cross-site s...

CVE-2018-20881

cPanel before 74.0.8 allows self stored XSS on the Security Questions login page SEC-446...

Cross site scripting

Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, as the view 'state' aka Run State state.php does no input validation to the value supplied to the 'New State' aka newState field, allowing an attacker to execute HTML or JavaScript code...

CVE-2019-7331

Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3 while editing an existing monitor field named "signal check color" monitor.php. There exists no input validation or output filtration, leaving it vulnerable to HTML Injection and an XSS attack...

Cross site scripting

Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'group' as it insecurely prints the 'Group Name' value on the web page without applying any proper filtration...

Cross site scripting

Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value in the view user user.php because proper filtration is omitted...