Cross site scripting

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause script execution when the request of a privileged account accessing the vulnerable web page is intercepted. Affected Products: 1-Phase Uninterruptible Power Supply UP...

Cross site scripting

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists which could cause arbritrary script execution when a malicious file is read and displayed. Affected Products: 1-Phase Uninterruptible Power Supply UPS using NMC2 including Smart-UPS,...

Information disclosure

A CWE-200: Information Exposure vulnerability exists which could cause the troubleshooting archive to be accessed. Affected Products: 1-Phase Uninterruptible Power Supply UPS using NMC2 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 NMC2: AP9630/AP9630CH/AP9630J,...

Cross site scripting

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC. Affected Products: 1-Phase Uninterruptible Power...

CVE-2021-22815

A CWE-200: Information Exposure vulnerability exists which could cause the troubleshooting archive to be accessed. Affected Products: 1-Phase Uninterruptible Power Supply UPS using NMC2 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 NMC2: AP9630/AP9630CH/AP9630J,...

CVE-2021-22813

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to an edit policy file. Affected Products:...

CVE-2021-22813

CVE-2021-22813 is a Cross‑Site Scripting (CWE-79) vulnerability affecting Schneider Electric NMC/NMC2/NMC3 devices across UPS, PDU, and related network cards. A privileged user can trigger arbitrary script execution by clicking a malicious URL referencing an edit policy file. The connected docume...

CVE-2021-22812

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC. Affected Products: 1-Phase Uninterruptible Power...

CVE-2021-22812

CVE-2021-22812 is a Cross-Site Scripting (CWE-79) vulnerability affecting Schneider Electric NMC/NMC2/NMC3 embedded devices and related UPS, PDU, and cooling products. Affected items include NMC2/NMC3 applications across various AP9630/9631/9635/9640/9641/9643 series and related RPDU2G, RPP, XRDP...

CVE-2021-22811

CVE-2021-22811 is a cross-site scripting vulnerability in Schneider Electric NMC/NMC2/NMC3 web interfaces. The issue could permit arbitrary script execution when a privileged user accesses a vulnerable web page or when a malicious URL crafted for the NMC is used. Affected products span multiple S...

CVE-2021-22810

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to a delete policy file. Affected Products:...

CVE-2021-22810

Schneider Electric NMC/NMC2/NMC3 devices are affected by CWE-79 Cross-site Scripting. A malicious URL can trigger script execution on privileged accounts when targeting delete policy or similar web pages. Affected products span NMC2/NMC3-based UPS, PDU, and related components (e.g., NMC2 AOS v6.9...

PT-2022-9285 · Apc · Apc Rack Power Distribution Units +19

Name of the Vulnerable Software and Affected Versions: APC Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 NMC2 versions 6.9.8 and earlier APC Symmetra PX 250/500 SYPX Network Management Card 2 NMC2 versions 6.9.6 and earlier APC Symmetra PX 48/96/100/160 kW UPS PX2, Symmetra ...

CVE-2021-44201

Cross-site scripting XSS was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 28035...

Cross site scripting

Cross-site scripting XSS was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 28035...

CVE-2021-44201 Cross-site scripting (XSS) was possible in notification pop-ups

Cross-site scripting XSS was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 28035...

CVE-2021-44201

CVE-2021-44201 affects Acronis Cyber Protect 15 (Windows, Linux) before build 28035. The vulnerability is a cross-site scripting (XSS) in notification pop-ups caused by failing to validate user input data, enabling potential client-side code execution. Per the connected records, the issue is netw...

Schneider Electric NMC cards and Embedded Devices

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Network Management Cards NMC and NMC Embedded Devices Vulnerabilities: Cross-site Scripting, Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION...

Ad-blocker Chrome extension AllBlock injected ads in Google searches

By Deeba Ahmed AllBlock was available on Google Chrome's Web Store where it is marketed as a potent Ad Blocker focusing on Facebook and YouTube to prevent pop-ups. This is a post from HackRead.com Read the original post: Ad-blocker Chrome extension AllBlock injected ads in Google searches...

CVE-2021-41109 LiveQuery publishes user session tokens

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...