CVE-2024-20405

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are...

CVE-2024-20405

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are...

The vulnerability of the user interface of the SAP CRM WebClient UI, which allows an attacker to perform XSS attacks.

The vulnerability of the SAP CRM WebClient UI user interface lies in the lack of security measures taken to protect the web page structure. Exploiting this vulnerability allows an attacker to execute XSS attacks remotely...

RHEL 8 : resteasy (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - RESTEasy: creation of insecure temp files CVE-2023-0482 Note that Nessus has not tested for this issue but has...

CVE-2023-38551

A CRLF Injection vulnerability in Ivanti Connect Secure 9.x, 22.x allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack...

CVE-2024-35283

CVE-2024-35283 affects the Mitel MiContact Center Business Ignite component. Affected software: MiContact Center Business versions through 10.0.0.4. Description in connected docs shows a vulnerability due to insufficient input validation that could allow an unauthenticated attacker to perform a s...

CVE-2024-35583

A cross-site scripting XSS vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Remarks input field...

CVE-2024-5415

A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/backup.php, 'comments' and 'db' parameters. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to...

Oracle Linux 8 : container-tools:ol8 (ELSA-2024-2988)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2988 advisory. - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type wh...

CVE-2024-5405

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via /tools/redis.php page in the k, hash, key and p parameters. This vulnerability could allow a remote user to submit a specially crafted JavaScript payload for an authenticated user to retrieve their session details...

CVE-2024-5406 Multiple vulnerabilities in WinNMP from Wtriple

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via index page in from, subject, text and hash parameters. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their session details...

CVE-2024-5406 Multiple vulnerabilities in WinNMP from Wtriple

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via index page in from, subject, text and hash parameters. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their session details...

CVE-2024-5406

CVE-2024-5406 affects WinNMP 19.02, where an XSS flaw exists in the index page via the from, subject, text, and hash parameters. A remote attacker could send a specially crafted query to an authenticated user, potentially stealing session details. The NVD entry lists CVSSv3.1: AV:N/AC:L/PR:N/UI:R...

CVE-2024-5405 Multiple vulnerabilities in WinNMP from Wtriple

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via /tools/redis.php page in the k, hash, key and p parameters. This vulnerability could allow a remote user to submit a specially crafted JavaScript payload for an authenticated user to retrieve their session details...

PT-2024-36025 · Rhinos +1 · Rhinos +1

Name of the Vulnerable Software and Affected Versions: RhinOS versions 3.0-1190 Description: The issue allows for an XSS attack via the tamper parameter in the "/admin/lib/phpthumb/phpthumb.php" API endpoint. An attacker could create a malicious URL and send it to a victim to obtain their session...

PT-2024-36022 · Rhinos · Rhinos

Name of the Vulnerable Software and Affected Versions: RhinOS versions 3.0-1190 Description: The issue allows a remote attacker to steal user session details by submitting a specially crafted URL, exploiting an XSS vulnerability through the search parameter of the "/portal/search.htm" API endpoin...

Cisco Secure Email and Web Manager Multiple Vulnerabilities (cisco-sa-esa-sma-wsa-xss-bgG5WHOD)

According to its self-reported version, Cisco Secure Email and Web Manager is affected by multiple vulnerabilities. - A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email could allow an authenticated, remote attacker to conduct an XSS attack again...

CVE-2024-2301

Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting XSS attack via the web management interface of the device...

CVE-2024-2301

CVE-2024-2301 concerns HP LaserJet Pro devices vulnerable to Cross-Site Scripting (XSS) via the web management interface. Evidence across multiple feeds indicates a web-based XSS weakness in HP LaserJet Pro printers, with the underlying issue described as an XSS vulnerability in the device’s web ...

PT-2024-40122 · Neos · Neos

Name of the Vulnerable Software and Affected Versions: Neos versions 2.0.x Description: The issue allows for several XSS attacks, enabling an attacker to tamper with page rendering, redirect victims to a fake login page, or capture user credentials. An attacker could also gain access to the serve...