CVE-2021-43063

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage...

CVE-2021-43063: Improper Neutralization of Input During Web Page Generation

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage...

PT-2021-6386

Name of the Vulnerable Software and Affected Versions Microsoft Office Visio affected versions not specified Description The issue is related to errors in data type conversion when implementing the EMR COMMENT EMFPLUS record in an EMF file. Exploitation of this issue may allow an attacker to...

PT-2021-23740

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.2.6 and below FortiWeb versions 6.3.15 and below FortiWeb versions 6.4.0 and 6.4.1 Description The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This...

FortiWeb - Reflected cross-site scripting in error controllers

Multiple improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 in FortiWeb may allow an unauthenticated user to inject malicious javascript code into the response webpage via crafted requests to device's error handlers...

Chaty Free < 2.8.3 & Pro < 2.8.2 - Reflected Cross-Site Scripting

The plugins do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting http://example.com/wp-admin/admin.php?page=chaty-contact-form-feed&search=%3C%2Fscript%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E...

CVE-2021-23259

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotelyRCE...

Design/Logic Flaw

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotelyRCE...

CVE-2021-23259 Groovy Sandbox Bypass

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotelyRCE...

Fuji Electric V-Server Lite Buffer Overflow DoS

The vulnerability of the monitoring software for PLK devices from Fuji Electric, V-Server Lite and Tellus Lite V-Simulator, lies in the fact that the recording operation goes beyond the buffer boundaries into memory during the syntactic analysis of V9 files in the V-Simulator module. Exploiting...

Internet Explorer Script Buffer Overflow

The vulnerability of JScript and VBScript script handlers in Internet Explorer is related to the execution of operations beyond the buffer boundaries. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure by using a specially crafted web page...

CVE-2021-42703

This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action...

CVE-2021-42703

Vulnerability context: CVE-2021-42703 corresponds to a cross‑site scripting flaw in Advantech WebAccess HMI Designer (pre‑2.1.11.0). The issue stems from insufficient input filtering/escaping of user‑submitted parameters, enabling attacker‑supplied JavaScript to execute in the affected web contex...

CVE-2021-42703 AzeoTech DAQFactory

This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action...

Google Assistant Authentication Bypass Vulnerability

Google Assistant suffered from an authentication bypass vulnerability allowing a webpage to execute commands without permission. Auth Bypass in Google Assistant Summary: Webpage can execute Google Assistant commands without any permissions Steps to reproduce: Generate the TTS audio files using th...

Vulnerabilities fixed in Cisco Webex

Vulnerabilities have been fixed in Cisco Webex. The vulnerabilities marked CVE-2021-1500 and CVE-2021-40128 allow an unauthenticated remote malicious person able to trick a user to trick a user into opening a rogue Web page. The vulnerability with reference CVE-2021-40115 allows a malicious perso...

CVE-2021-38509

Due to an unusual sequence of attacker-controlled events, a Javascript alert dialog with arbitrary although unstyled contents could be displayed over top an uncontrolled webpage of the attacker's choosing. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...

CVE-2021-38509

Due to an unusual sequence of attacker-controlled events, a Javascript alert dialog with arbitrary although unstyled contents could be displayed over top an uncontrolled webpage of the attacker's choosing. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...

CVE-2021-1821

A logic issue was addressed with improved state management. This issue is fixed in watchOS 7.6, macOS Big Sur 11.5. Visiting a maliciously crafted webpage may lead to a system denial of service...

Denial of service

A logic issue was addressed with improved state management. This issue is fixed in watchOS 7.6, macOS Big Sur 11.5. Visiting a maliciously crafted webpage may lead to a system denial of service...