PT-2021-17354

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2020 version 1.01rc001 Description: This issue allows network-adjacent attackers to disclose sensitive information on affected installations. Authentication is not required to exploit this issue. The flaw exists within the processi...

Cross site scripting

Cross-site scripting XSS vulnerability in Dashboards section in Kaa IoT Platform v1.2.0 allows remote attackers to inject malicious web scripts or HTML Injection payloads via the Description parameter...

Kaa IoT Platform 1.2.0 Cross Site Scripting

Exploit Title: Kaa IoT Platform 1.2.0 Cross Site Scripting XSS Vulnerability Date: 2020-10-01 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://www.kaaproject.org/ Software Link: https://cloud.kaaiot.com/ Version: 1.2.0 Tested on: Kali Linux 2020.3 CVE: CVE-2020-26701 Proof Of Concept:...

Cross-site Scripting (XSS)

markdown-it-katex is vulnerable to cross-site scripting. The vulnerability exists in index.js once the parser return an error it returns katex without sanitizing as HTML tags, allowing a malicious user to inject and execute arbitrary web scripts...

Cross-site Scripting (XSS)

sonata-project/admin-bundle is vulnerable to cross-site scripting XSS attacks. The library does not properly escape item.label in function templateResult in sonatatypemodelautocomplete.html.twig, allowing a malicious user to inject and execute arbitrary web scripts...

Cross-site Scripting (XSS)

paypal/merchant-sdk-php is vulnerable to cross-site scriptingXSS attacks. The vulnerability exists due to insufficient filtration of user-supplied data in token HTTP GET parameter in samples/AccountAuthentication/GetAuthDetails.html.php, allowing a malicious user to inject and execute arbitrary w...

Cross-site Scripting (XSS)

buefy is vulnerable to cross-site scriptingXSS attacks. The vulnerability exists in b-taginput in Autocomplete.vue the use of v-html when auto-complete is set to true, allowing a malicious user to inject and execute arbitrary web scripts...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/index.php by adding a question mark ? followed by the payload...

Oracle Siebel Sales Cross-Site Scripting

A cross-site scripting vulnerability exists in Oracle Siebel Sales. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web scripts into the affected system...

NewStart CGSL MAIN 5.04 : mailman Vulnerability (NS-SA-2019-0008)

The remote NewStart CGSL host, running version MAIN 5.04, has mailman packages installed that are affected by a vulnerability: - A cross-site scripting XSS flaw was found in mailman. An attacker, able to trick the user into visiting a specific URL, can execute arbitrary web scripts on the user's...

CVE-2018-16248

b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request...

Cross site request forgery (csrf)

b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request...

CVE-2018-16248

b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request...

XSS Vulnerability in JEESNS Article Comments

JEESNS is an open source social management system developed on JAVA's enterprise-class platform. JEESNS article comments at the XSS vulnerability , an attacker can use the vulnerability to inject arbitrary Web script or HTML...

httpd: privilege escalation from modules scripts

A flaw was found in Apache where code executing in a less-privileged child process or thread could execute arbitrary code with the privilege of the parent process usually root. An attacker having access to run arbitrary scripts on the web server PHP, CGI etc could use this flaw to run code on the...

Cross site scripting

A reflected Cross-Site scripting XSS vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the Login Form...

CVE-2018-18692

CVE-2018-18692 is a reflected XSS vulnerability in SEMCO Semcosoft 5.3. The issue allows an attacker to inject arbitrary web scripts or HTML through the username parameter on the Login Form. Affected component: login form handling in Semcosoft 5.3; root cause: insufficient sanitization/escaping o...

Ubuntu: Security Advisory (USN-3563-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-3463-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

D-Link Central WiFiManager Cross-Site Scripting (CVE-2018-17441; CVE-2018-17443)

Multiple cross-site scripting vulnerabilities exist in D-Link Central WiFiManager Software Controller. Successful exploitation of the vulnerabilities would allow remote attackers to inject arbitrary web scripts into the affected system...