CVE-2022-31492: Improper Neutralization of Input During Web Page Generation

Cross Site scripting XSS vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroupadminadd.php Username...

Authentication flaw

Riverbed AppResponse 11.8.0, 11.8.5, 11.8.5a, 11.9.0, 11.9.0a, 11.10.0, 11.11.0, 11.11.0a, 11.11.1, 11.11.1a, 11.11.5, and 11.11.5a when configured to use local, RADIUS, or TACACS authentication logs usernames and passwords if either is entered incorrectly. If a user enters an incorrect username...

CVE-2022-29732

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting XSS vulnerability via the Username parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2022-29732

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting XSS vulnerability via the Username parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2022-26978

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint. The osusername parameters is not correctly sanitized, leading to reflected XSS...

CVE-2022-24581

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software...

Cross site scripting

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting XSS vulnerability via the Username parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

Delta Controls enteliTOUCH cross-site scripting vulnerability

Delta Controls enteliTOUCH is a touchscreen building controller from Delta Controls Canada. A security vulnerability exists in Delta Controls enteliTOUCH versions 3.40.3935, 3.40.3706, and 3.33.4005, which stems from a cross-site scripting vulnerability discovered via the Username parameter. The...

PT-2022-17901 · Bigbluebutton · Bigbluebutton Greenlight

Name of the Vulnerable Software and Affected Versions: BigBlueButton Greenlight version 2.11.1 Description: The issue allows for XSS, where a threat actor could have a username containing a JavaScript payload. This payload gets executed in the browser of the victim in the "Share room access" dial...

PT-2022-18156

Name of the Vulnerable Software and Affected Versions Barco Control Room Management Suite web application version prior to 3.14 Description The issue concerns the exposure of a URL "/checklogin.jsp" endpoint, where the os username parameter is not correctly sanitized. This leads to reflected XSS,...

CVE-2022-29732

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting XSS vulnerability via the Username parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2022-29732: Improper Neutralization of Input During Web Page Generation

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting XSS vulnerability via the Username parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

PT-2022-19805

Name of the Vulnerable Software and Affected Versions Delta Controls enteliTOUCH versions 3.33.4005, 3.40.3706, 3.40.3935 Description A cross-site scripting XSS issue was found, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload, specifically through the Username...

PT-2022-23716 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.2.3490 Description: This issue allows remote attackers to bypass authentication on affected installations. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL...

GHSA-CV24-VH45-4HJM Foxlor cross-site scripting (XSS) vulnerability

Multiple cross-site scripting XSS vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields...

Lin-CMS-Flask Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'...

GHSA-RVF8-C35M-8289 Lin-CMS-Flask Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'...

GHSA-4225-97PR-RR52 OpenStack Keystone allows information disclosure during account locking

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...

GHSA-V762-47VH-J7Q3 Feehi CMS vulnerable to Cross-site Scripting in Username Field

Feehi CMS 2.0.8 is affected by a cross-site scripting XSS vulnerability. When the user name is inserted as JavaScript code, browsing the post will trigger the XSS...

Feehi CMS vulnerable to Cross-site Scripting in Username Field

Feehi CMS 2.0.8 is affected by a cross-site scripting XSS vulnerability. When the user name is inserted as JavaScript code, browsing the post will trigger the XSS...