CVE-2020-25925

Cross Site Scripting XSS in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML via the "p4" field...

IceWarp WebClient 跨站脚本漏洞

Icewarp IceWarp WebClient is a web-based mail service client from IceWarp Icewarp. A cross-site scripting vulnerability exists in IceWarp WebClient, which stems from the P4 field of the product's Webmail Calender feature not validating user input data. The vulnerability can be exploited to execut...

GitHub Security Lab: [Java] CWE-918: Added URLClassLoader and WebClient SSRF sinks

This bug was reported directly to GitHub Security Lab...

CVE-2021-27956

CVE-2021-27956 affects Zoho ManageEngine ADSelfService Plus prior to version 6104. The vulnerability is a stored XSS in the /webclient/index.html#/directory-search user search page, exploitable via the e-mail address field. Root cause is unsanitized input stored on the page that allows injection ...

Information Disclosure

OMERO web is vulnerable to information disclosure. The vulnerability exists because the main webclient page loads various information about the current user such as their id, name and the groups they are in...

GHSA-GFP2-W5JM-955Q OMERO.web exposes some unnecessary session information in the page

Background OMERO.web loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. Some additional information being loaded is not used by the webclient and is being removed in this release. Impact OMERO.we...

OMERO.web exposes some unnecessary session information in the page

Background OMERO.web loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. Some additional information being loaded is not used by the webclient and is being removed in this release. Impact OMERO.we...

CVE-2020-17147

Dynamics CRM Webclient Cross-site Scripting Vulnerability...

CVE-2020-17147

Dynamics CRM Webclient Cross-site Scripting Vulnerability...

Cross site scripting

Dynamics CRM Webclient Cross-site Scripting Vulnerability...

CVE-2020-17147 Dynamics CRM Webclient Cross-site Scripting Vulnerability

...

CVE-2020-17147

CVE-2020-17147 is a cross-site scripting vulnerability affecting Microsoft Dynamics 365 on-premises / Dynamics CRM Webclient. Public records identify the flaw as an XSS risk in the Dynamics CRM Webclient that can spoof UI or exfiltrate data due to improper input validation. The CVE is linked to M...

Dynamics CRM Webclient Cross-site Scripting Vulnerability

...

KLA12026 Multiple vulnerabilities in Microsoft Dynamics

Multiple vulnerabilities were found in Microsoft Dynamics. Malicious users can exploit these vulnerabilities to spoof user interface, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A cross-site-scripting XSS vulnerability Dynamics CRM Webclie...

CVE-2020-15789

A vulnerability has been identified in Polarion Subversion Webclient All versions. The web interface could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user, who...

CVE-2020-15788

A vulnerability has been identified in Polarion Subversion Webclient All versions. The Polarion subversion web application does not filter user input in a way that prevents Cross-Site Scripting. If a user is enticed into passing specially crafted, malicious input to the web client e.g. by clickin...

Cross site request forgery (csrf)

A vulnerability has been identified in Polarion Subversion Webclient All versions. The web interface could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user, who...

Cross site scripting

A vulnerability has been identified in Polarion Subversion Webclient All versions. The Polarion subversion web application does not filter user input in a way that prevents Cross-Site Scripting. If a user is enticed into passing specially crafted, malicious input to the web client e.g. by clickin...

CVE-2020-15789

A vulnerability has been identified in Polarion Subversion Webclient All versions. The web interface could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user, who...

CVE-2020-15789

CVE-2020-15789 affects Siemens Polarion Subversion Webclient (all versions). The connected documents confirm two CSRF-related issues in the web interface: a CSRF vulnerability that could trigger state-changing actions via forged requests, requiring a legitimate user to perform an authenticated ac...