Cross site scripting

IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205045...

Arista Networks MOS Licensing Issue Vulnerability

Arista Networks MOS is a fully programmable and highly modular Linux-based network operating system from Arista Networks, Inc. that uses the familiar industry standard CLI and runs a single binary software image in the Arista switch family. The vulnerability can be exploited to allow an...

Authentication flaw

In Arista's MOS Metamako Operating System software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unprivileged users who are accessing the Web UI. This issue affects: Arista Metamako Operating System MOS-0.34.0 and prior releases...

Netgear Smart Switches Open to Complete Takeover

Three severe Netgear vulnerabilities, codenamed Demon’s Cries, Draconian Fear and Seventh Inferno by the researcher that found them, affect 20 of the company’s managed smart switches and could allow an attacker to take them over. The bugs were patched on Friday with zero technical details made...

The vulnerability of the Telerik.Web.UI.dll library of the Telerik UI software for ASP.NET AJAX and the Sitefinity web content management system allows a attacker to exploit the encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or MachineKey).

The vulnerability of the Telerik.Web.UI.dll library of the Telerik UI software for ASP.NET AJAX and the Sitefinity web content management system is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to disclose encryption keys...

CVE-2021-34765

A vulnerability in the web UI for Cisco Nexus Insights could allow an authenticated, remote attacker to view and download files related to the web application. The attacker requires valid device credentials. This vulnerability exists because proper role-based access control RBAC filters are not...

Design/Logic Flaw

A vulnerability in the web UI for Cisco Nexus Insights could allow an authenticated, remote attacker to view and download files related to the web application. The attacker requires valid device credentials. This vulnerability exists because proper role-based access control RBAC filters are not...

CVE-2021-34765

Cisco Nexus Insights suffers an authenticated information-disclosure vulnerability in its web UI where RBAC filters are not applied to file download actions. An attacker with valid device credentials can log in and access the directory listing to download restricted files, exposing sensitive info...

IBM Planning Analytics Cross-Site Scripting Vulnerability (CNVD-2021-71524)

IBM Planning Analytics, a planning, budgeting, forecasting and analytics solution, is vulnerable to a cross-site scripting vulnerability in IBM Planning Analytics version 2.0. An attacker could use this vulnerability to embed arbitrary JavaScript code in the Web UI, which could change the intende...

CVE-2021-29852

IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205528...

Cross site scripting

IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205528...

CVE-2021-29852

CVE-2021-29852 affects IBM Planning Analytics Local 2.0; a cross-site scripting flaw in the Web UI could allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected: IBM Planning Analytics Local 2.0 (Planning Analytics Workspace). Root cause: XSS i...

Cisco Nexus Insights Authenticated Information Disclosure Vulnerability

A vulnerability in the web UI for Cisco Nexus Insights could allow an authenticated, remote attacker to view and download files related to the web application. The attacker requires valid device credentials. This vulnerability exists because proper role-based access control RBAC filters are not...

CVE-2021-34765

A vulnerability in the web UI for Cisco Nexus Insights could allow an authenticated, remote attacker to view and download files related to the web application. The attacker requires valid device credentials. This vulnerability exists because proper role-based access control RBAC filters are not...

Cisco Application Policy Infrastructure Controller Stored XSS (cisco-sa-capic-scss-bFT75YrM)

According to its self-reported version, Cisco Application Policy Infrastructure Controller is affected by a stored cross-site scripting XSS vulnerability in its Web UI component due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can...

CVE-2021-29743

IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...

Cross site scripting

IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...

CVE-2021-29743

IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...

CVE-2021-29744

IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 2016...

Cross site scripting

IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 2016...