EUVD-2020-15596

Malware in sbrugna...

Cross-site Scripting (XSS)

rails-html-sanitizer is vulnerable to cross-site scripting XSS attacks. Attackers can use non-whiltelisted attributes within sanitized output to inject and execute arbitrary webscript...

Cross-site Scripting (XSS)

spring-batch-admin-manager is vulnerable to stored cross-site scripting XSS attacks. Attackers can inject arbitrary webscript or HTML using the file upload feature...

Cross-site Scripting (XSS)

dijit is vulnerable to cross-site scripting XSS attacks. Attackers can execute arbitrary webscript through the onload attributes of SVG elements...

Cross-site Scripting (XSS)

Kibana is vulnerable to cross-site scripting XSS attacks. This is because the visualization title is enabled in render function of visualizeembeddablefactory.js which allows an attacker to inject and execute arbitrary webscript...

Cross-site Scripting (XSS)

Kibana is vulnerable to cross-site scripting XSS attacks. Attackers can use the labs visualizations in Kibana to insert and execute arbitrary webscript...

Cross-site Scripting (XSS)

MapProxy is vulnerable to cross-site scripting XSS attacks. Attackers can use the format and srs parameters in the demo page to inject and execute arbitrary webscript...

Cross-site Scripting (XSS)

symphonycms/symphony-2 is vulnerable to cross-site scripting XSS attacks. The application does not properly sanitize multiple parameters in the symphony/content/content.publish.php file. This allows an authenticated malicious user to inject and execute arbitrary webscript...

Cross-site Scripting (XSS)

github.com/koding/koding is vulnerable to cross-site scripting XSS attacks. The library does not properly encode content in client/Main/CommonViews/suggestedtokenview.coffee, allowing a malicious user to inject and execute arbitrary webscript...

Cross-site Scripting (XSS)

dweeves/magmi is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the profile variable before rendering the profile panel, allowing a malicious user to inject and execute arbitrary webscript...

Cross-site Scripting (XSS)

keystone is vulnerable to cross-site scripting XSS attacks. Authenticated administrators can leverage the lack of sanitization in the content brief and content extended fields to inject and execute arbitrary webscript...

Cross-site Scripting (XSS)

keystone is vulnerable to cross-site scripting XSS attacks. These attacks are possible through the fields/types/markdown/MarkdownType.js file because the markdown is not sanitized. This allows attackers to inject and execute arbitrary webscript...

Cross-site Scripting (XSS)

typo3/cms is vulnerable to cross-site scripting XSS attacks. The application contains a .swf file that is that fails to sanitize user input, allowing a malicious user to inject and execute arbitrary webscript...

Cross-site Scripting (XSS)

WordPress is vulnerable to cross-site scripting XSS attacks. The library does not properly handle HTML elements in the oEmbed sandbox before rendering, allowing a malicious user to inject and execute arbitrary webscript...

Cross-site Scripting (XSS)

kallithea is vulnerable to cross-site scripting XSS attacks. The does not properly sanitize multiple strings, allowing a malicious user to inject and execute arbitrary webscript...

Cross-Site Scripting (XSS)

drupal/core is susceptible to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary webscript through the title field when a node is created through the quick edit module...

Cross-site Scripting (XSS)

automattic/jetpack is vulnerable to cross-site scripting XSS attacks. The library does not parse LaTeX markup correctly, allowing a malicious user to inject and execute arbitrary webscript...

Cross-Site Scripting (XSS)

WordPress is vulnerable to cross-site scripting XSS attacks. The application uses offsite redirects which allows the attackers to inject and execute arbitrary webscript...

Cross-site Scripting (XSS)

WordPress is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary webscript through the name or version header of a plugin...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary webscript through additionalhtmlhead, additionalhtmltopofbody, or additionalhtmlfooter...