Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL MariaDB PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).


Cross-site

scripting

(XSS)

vulnerability

in

the

Asset

module's

category

selector

input

field

in

Liferay

Portal

and

Liferay

DXP

before

fix

pack

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

_com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title

parameter.


IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205281.


IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system including cross-site scripting cache poisoning or session hijacking


IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 200966.


IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204264.


A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain resulting in a Universal Cross-Site Scripting vulnerability. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Further details are being temporarily withheld to allow users an opportunity to update.*. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3.


IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205684.


IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204348.


IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204279.


IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request a remote attacker could exploit this vulnerability to inject HTTP HOST header which will allow the attacker to conduct various attacks against the vulnerable system including cross-site scripting cache poisoning or session hijacking. IBM X-Force ID: 206228.


IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204269.


IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204334.


Cross-site

scripting

(XSS)

vulnerability

in

the

Layout

module's

page

administration

page

in

Liferay

Portal

and

Liferay

DXP

before

fix

pack

and

before

fix

pack

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name

parameter.


IBM Security Guardium 10.5 10.6 11.0 11.1 11.2 and 11.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207828.


IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 201693.


IBM Tivoli Netcool/OMNIbus_GUI and IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


Cross-site

scripting

(XSS)

vulnerability

in

the

Site

module's

membership

request

administration

pages

in

Liferay

Portal

through

and

Liferay

DXP

before

fix

pack

before

fix

pack

before

fix

pack

and

before

fix

pack

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

_com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments

parameter.


IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204345.


IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204262.


IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199406.


IBM Business Automation Workflow 18.0 19.0 20.0 and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204833.


IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199408.


Cross-site

scripting

(XSS)

vulnerability

in

the

Redirect

module's

redirection

administration

page

in

Liferay

Portal

through

and

Liferay

DXP

before

fix

pack

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

_com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL

parameter.


IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204346.


IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205528.


IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204263.


IBM Business Automation Workflow 18.0.0.0 18.0.0.1 18.0.0.2 19.0.0.1 19.0.0.2 19.0.0.3 20.0.0.1 20.0.0.2 and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204832.


IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204347.


IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204270.


Cross-site

scripting

(XSS)

vulnerability

in

the

Asset

module's

Asset

Publisher

app

in

Liferay

Portal

through

and

Liferay

DXP

before

fix

pack

before

fix

pack

and

before

fix

pack

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId

parameter.


IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204340.


Multiple stored cross-site scripting (XSS) vulnerabilities in Sourcecodester Equipment Inventory System 1.0 allow remote attackers to inject arbitrary javascript via any \Add\ sections such as Add Item Employee and Position or others in the Name Parameters.


Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99 7.1 before fix pack 23 7.2 before fix pack 12 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.


There are multiple persistent cross-site scripting (XSS) vulnerabilities in the web interface of OpenText Content Server Version 20.3. The application allows a remote attacker to introduce arbitrary JavaScript by crafting malicious form values that are later not sanitized.


A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. No additional action is required for these instances. This issue impacts: Prisma Cloud Compute 20.12 versions earlier than Prisma Cloud Compute 20.12.552; Prisma Cloud Compute 21.04 versions earlier than Prisma Cloud Compute 21.04.439.


Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already logged in to Open-AudIT before they click the malicious link.


OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting (XSS). A remote attacker could exploit this vulnerability by injecting arbitrary code via de uuid parameter.


grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')


Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Note that login rights to Velociraptor is nearly always reserved for trusted and verified users with IT security backgrounds.


Wfilter ICF 5.0.117 contains a cross-site scripting (XSS) vulnerability. An attacker in the same LAN can craft a packet with a malicious User-Agent header to inject a payload in its logs where an attacker can take over the system by through its plugin-running function.


DouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud.php.


i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE SM2__C__MONITORING__CONFIG__TITLE C__MONITORING__CONFIG__PATH SM2__C__MONITORING__CONFIG__PATH C__MONITORING__CONFIG__ADDRESS or SM2__C__MONITORING__CONFIG__ADDRESS.


A reflected cross-site scripting (XSS) vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to mislead another authenticated PAN-OS administrator to click on a specially crafted link that performs arbitrary actions in the PAN-OS web interface as the targeted authenticated administrator. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.20; PAN-OS 9.0 versions earlier than 9.0.14; PAN-OS 9.1 versions earlier than 9.1.10; PAN-OS 10.0 versions earlier than 10.0.2. This issue does not affect Prisma Access.


A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php?action=initLogon or modules/admin/DELETEIMAGES.php.


Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.


The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4 ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.


Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers) Access Points ADSL + DSL Gateways and Routers which affects TD-W9977v1 TL-WA801NDv5 TL-WA801Nv6 TL-WA802Nv5 and Archer C3150v2 devices through the improper validation of the hostname. Some of the pages including dhcp.htm networkMap.htm dhcpClient.htm qsEdit.htm and qsReview.htm and use this vulnerable hostname function (setDefaultHostname()) without sanitization.


django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')


EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product.


Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific search criterion and operator combination in Filtered Asset Search could have allowed a user to pass code through the provided search field. This issue affects version 6.6.80 and prior and is fixed in 6.6.81. If your Security Console currently falls on or within this affected version range ensure that you update your Security Console to the latest version.


A Stored Cross-site scripting (XSS) vulnerability in /main.html Wifi Settings in Tenda AC5 AC1200 version V15.03.06.47_multi allows remote attackers to inject arbitrary web script or HTML via the Wifi Name parameter.


CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a cookie to perform user redirection to a malicious website.


A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror (in the URL field of the Parameters tab).


Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS).


Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user. These vulnerabilities exist because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. To exploit these vulnerabilities the attacker would need valid administrative credentials.


Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack and obtain potentially confidential information by leveraging a flaw in the authentication mechanism. For more information about these vulnerabilities see the Details section of this advisory.


Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and Cisco Unity Connection could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against an interface user. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a remote attacker with network-operator privileges to conduct a cross-site scripting (XSS) attack or a reflected file download (RFD) attack against a user of the interface. For more information about these vulnerabilities see the Details section of this advisory.


Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Virtualized Voice Browser could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco IOS XE Wireless Controller software for the Catalyst 9000 Family of switches could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against another user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by authenticating to the device as a high-privileged user adding certain configurations with malicious code in one of its fields and persuading another user to click on it. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive browser-based information.


A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to improper input validation of log file content stored on the affected device. An attacker could exploit this vulnerability by modifying a log file with malicious code and getting a user to view the modified log file. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Unified Intelligence Center Software could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A vulnerability in an API of Cisco SD-WAN vManage Software could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the application web-based interface. This vulnerability exists because the API does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending malicious input to the API. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web-based interface or access sensitive browser-based information.


A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability is due to improper input validation in the web UI. An authenticated attacker could exploit this vulnerability by sending malicious input to the web UI. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web-based interface or access sensitive browser-based information.


Microsoft Dynamics Business Central Cross-site Scripting Vulnerability


Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit these vulnerabilities by injecting malicious code into the web-based management interface and persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. An attacker needs valid administrator credentials to inject the malicious script code.


A vulnerability in the web-based management interface of Cisco DNA Center software could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. To exploit this vulnerability an attacker would need to have administrative credentials on the affected device.


A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface.


A Cross-site Scripting (XSS) vulnerability in J-Web on Juniper Networks Junos OS allows an attacker to target another user's session thereby gaining access to the users session. The other user session must be active for the attack to succeed. Once successful the attacker has the same privileges as the user. If the user has root privileges the attacker may be able to gain full control of the device. This issue affects: Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S15 on EX Series; 12.3X48 versions prior to 12.3X48-D95 on SRX Series; 15.1 versions prior to 15.1R7-S6 on EX Series; 15.1X49 versions prior to 15.1X49-D200 on SRX Series; 16.1 versions prior to 16.1R7-S7; 16.2 versions prior to 16.2R2-S11 16.2R3; 17.1 versions prior to 17.1R2-S11 17.1R3-S2; 17.2 versions prior to 17.2R3-S3; 17.3 versions prior to 17.3R2-S5 17.3R3-S7; 17.4 versions prior to 17.4R2-S9 17.4R3; 18.1 versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R2-S7 18.2R3-S3; 18.3 versions prior to 18.3R1-S7 18.3R2-S3 18.3R3-S1; 18.4 versions prior to 18.4R1-S6 18.4R2-S4 18.4R3; 19.1 versions prior to 19.1R2-S1 19.1R3; 19.2 versions prior to 19.2R1-S3 19.2R2; 19.3 versions prior to 19.3R2.


Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to Stored Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0plus205 and prior versions.


On version 16.x before 16.1.0 15.1.x before 15.1.4 14.1.x before 14.1.4.4 and all versions of 13.1.x 12.1.x and 11.6.x a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to reflected Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0plus205 and prior versions.


On all 7.x and 6.x versions (fixed in 8.0.0) undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


On all versions of 16.1.x 16.0.x 15.1.x 14.1.x 13.1.x 12.1.x and 11.6.x a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


The package github.com/argoproj/argo-cd/cmd before 1.7.13 from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.


An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webviews.


This affects the package Crow before 0.3+4. When using attributes without quotes in the template an attacker can manipulate the input to introduce additional attributes potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability assuming an attacker can influence the value entered into the template. If the template is used to render user-generated content this vulnerability may escalate to a persistent XSS vulnerability.


The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.


On version 16.0.x before 16.0.1.2 15.1.x before 15.1.3.1 and 14.1.x before 14.1.4.3 a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


On BIG-IP version 16.0.x before 16.0.1.2 15.1.x before 15.1.3 14.1.x before 14.1.4.2 13.1.x before 13.1.4.1 and all versions of 12.1.x a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the main functionality. It accepts input that can result in the output (an anchor a tag) containing undesirable Javascript code that can be executed upon user interaction.


The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.


Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title &downloadable_file_version0.


On version 16.0.x before 16.0.1.2 15.1.x before 15.1.3.1 14.1.x before 14.1.4.2 13.1.x before 13.1.4.1 and all versions of 12.1.x a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document.


All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned leading to dangerouslySetInnerHTML being used which does not sanitize the output.


A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS QuTS hero and QuTScloud. If exploited this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS QuTS hero and QuTScloud: QTS 4.5.4.1991 build 20220329 and later QTS 5.0.0.1986 build 20220324 and later QuTS hero h5.0.0.1986 build 20220324 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTScloud c5.0.1.1949 and later


AEM's Cloud Service offering as well as version 6.5.10.0 (and below) are affected by a reflected Cross-Site Scripting (XSS) vulnerability via the itemResourceType parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page malicious JavaScript content may be executed within the context of the victim's browser


A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.


A vulnerability affecting F-Secure SAFE browser was discovered whereby browsers loads images automatically this vulnerability can be exploited remotely by an attacker to execute the JavaScript can be used to trigger universal cross-site scripting through the browser. User interaction is required prior to exploitation such as entering a malicious website to trigger the vulnerability.


In Bus Pass Management System v1.0 parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting vulnerability.


A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.


A vulnerability affecting F-Secure SAFE browser protection was discovered improper URL handling can be triggered to cause universal cross-site scripting through browsing protection in a SAFE web browser. User interaction is required prior to exploitation. A successful exploitation may lead to arbitrary code execution.


Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and (2) type parameter in an edit action in index.php.


MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.


In Ericsson CodeChecker through 6.18.0 a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.


Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters which allows a remote attacker to perform JavaScript injection for XSS (reflected Cross-site scripting) attack without authentication.


A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php.


Taocms v3.0.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Management Column component.


A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.


The Moova for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the lat parameter in the ~/Checkout/Checkout.php file which allows attackers to inject arbitrary web scripts in versions up to and including 3.5.


The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter found in the ~/inc/class.ajax.php file which allows attackers to inject arbitrary web scripts in versions up to and including 2.0.11.


A vulnerability in the web-based management interface of Cisco Prime Access Registrar could allow an authenticated remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. To exploit this vulnerability the attacker would need valid administrative credentials. Cisco expects to release software updates that address this vulnerability.


The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.2.


The

WP

Fusion

Lite

WordPress

plugin

is

vulnerable

to

Reflected

Cross-Site

Scripting

via

the

startdate

parameter

found

in

the

file

which

allows

attackers

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including


The

Simple

Behance

Portfolio

WordPress

plugin

is

vulnerable

to

Reflected

Cross-Site

Scripting

via

the

`dark`

parameter

in

the

file

which

allows

attackers

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including


Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update new UI) allows attackers to execute arbitrary JavaScript by modifying the \Domain Name\ field \Server Address\ field \User Name/Email\ or \Password/Key\ field.


A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later


The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `email` parameter in the ~/license.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.0.32.


The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names in versions up to and including 4.14.1.


The Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER'PHP_SELF' in the ~/multiplayergames.php file which allows attackers to inject arbitrary web scripts in versions up to and including 3.7.


A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


A remote cross-site scripting (XSS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.13 and below; Aruba Instant 6.5.x: 6.5.4.13 and below; Aruba Instant 8.3.x: 8.3.0.7 and below; Aruba Instant 8.4.x: 8.4.0.5 and below; Aruba Instant 8.5.x: 8.5.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.


Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities see the Details section of this advisory.


The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER'PHP_SELF' in the ~/securimage-wp.php file which allows attackers to inject arbitrary web scripts in versions up to and including 3.5.4.


A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QmailAgent. If exploited this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 ( 2021/08/25 ) and later


The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER'PHP_SELF' in the ~/simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.4.7.


The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saq_txt_the_filter parameter in the ~/wp-seo-tags.php file which allows attackers to inject arbitrary web scripts in versions up to and including 2.2.7.


The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the ~/pages/admin-page.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.0.


Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more information about these vulnerabilities see the Details section of this advisory.


The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which allows attackers to inject arbitrary web scripts in versions up to and including 4.6.


A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 5.4.10 ( 2021/08/19 ) and later Photo Station 5.7.13 ( 2021/08/19 ) and later Photo Station 6.0.18 ( 2021/09/01 ) and later


The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the api_key in the ~/views/settings.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.0.10.


A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of `$_SERVER'PHP_SELF'` in the ~/calendar.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.0.


The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `vws_notice` function found in the ~/inc/requirements.php file which allows attackers to inject arbitrary web scripts in versions up to and including 5.2.7.


A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later


The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/mmu_admin.php file which allows attackers to inject arbitrary web scripts in versions up to and including 0.0.4.


The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER'PHP_SELF' in the ~/jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts in versions up to and including 0.1.5.


The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the ~/wp_sidebarMenu.php file which allows attackers to inject arbitrary web scripts in versions up to and including 2.0.0.


The

WordPress

plugin

is

vulnerable

to

Reflected

Cross-Site

Scripting

via

the

text

function

found

in

the

file

which

allows

attackers

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including


The

Poll

Maker

WordPress

plugin

is

vulnerable

to

Reflected

Cross-Site

Scripting

via

the

mcount

parameter

found

in

the

file

which

allows

attackers

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including


A vulnerability in the web-based management interface of Cisco Tetration could allow an authenticated remote attacker to perform a stored cross-site scripting (XSS) attack on an affected system. This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. To exploit this vulnerability the attacker would need valid administrative credentials.


The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER'PHP_SELF' in the ~/wp-fountain.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.5.9.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. To exploit this vulnerability an attacker would need valid administrative credentials.


The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER'PHP_SELF' in the ~/skaut-bazar.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.3.2.


A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later


A Cross Site Scripting (XSS) vulnerabilty exists in Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi 1.0 via the Category parameter in an add function in category/index.php.


NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module.


NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService.


NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint.


NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile.


Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description Email (from/to/cc) System Name and System Location fields.


An issue was discovered in COINS Construction Cloud 11.12. Due to an inappropriate use of HTML IFRAME elements the file upload functionality is vulnerable to a persistent Cross-Site Scripting (XSS) attack.


QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at \adminuseredit.php?usertoedit=XSS\ as the user supplied input for the value of this parameter is not properly sanitized.


Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_process \count\ parameter via GET. No authentication is required.


A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35 and 7.11.x and 7.12.x before 7.12.2 allows a remote attacker to introduce arbitrary JavaScript via attachments upload a different vulnerability than CVE-2021-39267 and CVE-2021-39268.


Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes.


An issue was discovered in COINS Construction Cloud 11.12. Due to improper input neutralization it is vulnerable to reflected cross-site scripting (XSS) via malicious links (affecting the search window and activity view window).


A cross-site scripting vulnerability is present in Xbtit 3.1. The stored XSS vulnerability occurs because /ajaxchat/sendChatData.php does not properly validate the value of the \n\ (POST) parameter. Through this vulnerability an attacker is capable to execute malicious JavaScript code.


Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted commit to a wiki


Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property which is then displayed unsanitized in the affiliate-preview.php tag generation screen leading to a persistent cross-site scripting (XSS) vulnerability.


Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown


A

Improper

Neutralization

of

Input

During

Web

Page

Generation

('Cross-site

Scripting')

vulnerability

exists

that

could

cause

arbritrary

script

execution

when

a

privileged

account

clicks

on

a

malicious

URL

specifically

crafted

for

the

NMC

pointing

to

an

edit

policy

file.

Affected

Products:

Uninterruptible

Power

Supply

(UPS)

using

including

Smart-UPS

Symmetra

and

Galaxy

with

Network

Management

Card

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Symmetra

PX

(SYPX)

Network

Management

Card

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Symmetra

PX

kW

UPS

Symmetra

PX

kW

UPS

Gutor

(SXW

GVX)

and

Galaxy

(GVMTS

GVMSA

GVXTS

GVXSA

GFC

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Smart-UPS

Symmetra

and

Galaxy

with

Network

Management

Card

AOS

and

earlier)

APC

Rack

Power

Distribution

Units

(PDU)

using

Metered/Switched

Rack

PDUs

with

embedded

AOS

and

earlier)

APC

Rack

Power

Distribution

Units

(PDU)

using

Metered/Switched

Rack

PDUs

with

embedded

AOS

and

earlier)

APC

Power

Distribution

Products

using

Galaxy

RPP:

AOS

and

earlier)

Network

Management

Card

for

InfraStruxure

kVA

PDU

with

Poles

AOS

and

earlier)

Network

Management

Card

for

InfraStruxure

PDU

(XPDU)

M

AOS

and

earlier)

Network

Management

Card

for

Modular

PDU

(XRDP):

AOS

and

earlier)

Network

Management

Card

for

and

kVA

(PMM):

AOS

and

earlier)

Network

Management

Card

for

Modular

PDU

AOS

and

earlier)

Rack

Automatic

Transfer

Switches

(ATS)

Embedded

Rack

Automatic

Transfer

Switches

AOS

and

earlier)

Network

Management

Card

Cooling

Products:

InRow

Cooling

for

series

and

SKUs

InRow

Cooling

for

series

SKUs

InRow

Cooling

for

series

and

SKUs

InRow

Cooling

Display

for

series

InRow

Cooling

for

series

SKUs

InRow

Cooling

for

series

and

Ecoflair

Air

Economizer

Display

Uniflair

SP

(UNFLRSP)

Uniflair

LE

DX

Perimeter

Cooling

Display

for

SKUs:

IDAV

IDEV

IDWV

IUAV

IUEV

IUWV

IXAV

IXEV

IXWV

LDAV

LDEV

and

LDWV

Refrigerant

Distribution

Unit:

(RDU)

AOS

and

earlier)

Environmental

Monitoring

Unit

with

embedded

NetBotz

AOS

and

earlier)

and

Network

Management

Card

Battery

Management

System

AOS

and

earlier)


On BIG-IP AFM version 15.1.x before 15.1.1 14.1.x before 14.1.3.1 and 13.1.x before 13.1.3.5 authenticated users accessing the Configuration utility for AFM are vulnerable to a cross-site scripting attack if they attempt to access a maliciously-crafted URL. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1) EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1) and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to impersonate the user who manages the charging station or carry out actions on their behalf when crafted malicious parameters are submitted to the charging station web server.


Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown


A

Improper

Neutralization

of

Input

During

Web

Page

Generation

('Cross-site

Scripting')

vulnerability

exists

that

could

cause

arbritrary

script

execution

when

a

privileged

account

clicks

on

a

malicious

URL

specifically

crafted

for

the

NMC.

Affected

Products:

Uninterruptible

Power

Supply

(UPS)

using

including

Smart-UPS

Symmetra

and

Galaxy

with

Network

Management

Card

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Symmetra

PX

(SYPX)

Network

Management

Card

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Symmetra

PX

kW

UPS

Symmetra

PX

kW

UPS

Gutor

(SXW

GVX)

and

Galaxy

(GVMTS

GVMSA

GVXTS

GVXSA

GFC

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Smart-UPS

Symmetra

and

Galaxy

with

Network

Management

Card

AOS

and

earlier)

APC

Rack

Power

Distribution

Units

(PDU)

using

Metered/Switched

Rack

PDUs

with

embedded

AOS

and

earlier)

APC

Rack

Power

Distribution

Units

(PDU)

using

Metered/Switched

Rack

PDUs

with

embedded

AOS

and

earlier)

APC

Power

Distribution

Products

using

Galaxy

RPP:

AOS

and

earlier)

Network

Management

Card

for

InfraStruxure

kVA

PDU

with

Poles

AOS

and

earlier)

Network

Management

Card

for

InfraStruxure

PDU

(XPDU)

M

AOS

and

earlier)

Network

Management

Card

for

Modular

PDU

(XRDP):

AOS

and

earlier)

Network

Management

Card

for

and

kVA

(PMM):

AOS

and

earlier)

Network

Management

Card

for

Modular

PDU

AOS

and

earlier)

Rack

Automatic

Transfer

Switches

(ATS)

Embedded

Rack

Automatic

Transfer

Switches

AOS

and

earlier)

Network

Management

Card

Cooling

Products:

InRow

Cooling

for

series

and

SKUs

InRow

Cooling

for

series

SKUs

InRow

Cooling

for

series

and

SKUs

InRow

Cooling

Display

for

series

InRow

Cooling

for

series

SKUs

InRow

Cooling

for

series

and

Ecoflair

Air

Economizer

Display

Uniflair

SP

(UNFLRSP)

Uniflair

LE

DX

Perimeter

Cooling

Display

for

SKUs:

IDAV

IDEV

IDWV

IUAV

IUEV

IUWV

IXAV

IXEV

IXWV

LDAV

LDEV

and

LDWV

Refrigerant

Distribution

Unit:

(RDU)

AOS

and

earlier)

Environmental

Monitoring

Unit

with

embedded

NetBotz

AOS

and

earlier)

and

Network

Management

Card

Battery

Management

System

AOS

and

earlier)


UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS) which could allow an attacker to send malicious JavaScript code. This could result in hijacking of cookie/session tokens redirection to a malicious webpage and unintended browser action on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5 WebAccess/SCADA versions prior to 9.0.1).


Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.


Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS (Stored Cross-site scripting) attack.


Persistent Cross-Site scripting vulnerability in Micro Focus Application Performance Management product affecting versions 9.40 9.50 and 9.51. The vulnerability could allow persistent XSS attack.


A

Improper

Neutralization

of

Input

During

Web

Page

Generation

('Cross-site

Scripting')

vulnerability

exists

which

could

cause

arbritrary

script

execution

when

a

malicious

file

is

read

and

displayed.

Affected

Products:

Uninterruptible

Power

Supply

(UPS)

using

including

Smart-UPS

Symmetra

and

Galaxy

with

Network

Management

Card

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Symmetra

PX

(SYPX)

Network

Management

Card

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Symmetra

PX

kW

UPS

Symmetra

PX

kW

UPS

Gutor

(SXW

GVX)

and

Galaxy

(GVMTS

GVMSA

GVXTS

GVXSA

GFC

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Smart-UPS

Symmetra

and

Galaxy

with

Network

Management

Card

AOS

and

earlier)

APC

Rack

Power

Distribution

Units

(PDU)

using

Metered/Switched

Rack

PDUs

with

embedded

AOS

and

earlier)

APC

Rack

Power

Distribution

Units

(PDU)

using

Metered/Switched

Rack

PDUs

with

embedded

AOS

and

earlier)

APC

Power

Distribution

Products

using

Galaxy

RPP:

AOS

and

earlier)

Network

Management

Card

for

InfraStruxure

kVA

PDU

with

Poles

AOS

and

earlier)

Network

Management

Card

for

InfraStruxure

PDU

(XPDU)

M

AOS

and

earlier)

Network

Management

Card

for

Modular

PDU

(XRDP):

AOS

and

earlier)

Network

Management

Card

for

and

kVA

(PMM):

AOS

and

earlier)

Network

Management

Card

for

Modular

PDU

AOS

and

earlier)

Rack

Automatic

Transfer

Switches

(ATS)

Embedded

Rack

Automatic

Transfer

Switches

AOS

and

earlier)

Network

Management

Card

Cooling

Products:

InRow

Cooling

for

series

and

SKUs

InRow

Cooling

for

series

SKUs

InRow

Cooling

for

series

and

SKUs

InRow

Cooling

Display

for

series

InRow

Cooling

for

series

SKUs

InRow

Cooling

for

series

and

Ecoflair

Air

Economizer

Display

Uniflair

SP

(UNFLRSP)

Uniflair

LE

DX

Perimeter

Cooling

Display

for

SKUs:

IDAV

IDEV

IDWV

IUAV

IUEV

IUWV

IXAV

IXEV

IXWV

LDAV

LDEV

and

LDWV

Refrigerant

Distribution

Unit:

(RDU)

AOS

and

earlier)

Environmental

Monitoring

Unit

with

embedded

NetBotz

AOS

and

earlier)

and

Network

Management

Card

Battery

Management

System

AOS

and

earlier)


Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115 some older browsers (e.g. IE10) that do not automatically URL encode parameters were still vulnerable.


A

Improper

Neutralization

of

Input

During

Web

Page

Generation

('Cross-site

Scripting')

vulnerability

exists

that

could

cause

arbritrary

script

execution

when

a

privileged

account

clicks

on

a

malicious

URL

specifically

crafted

for

the

NMC

pointing

to

a

delete

policy

file.

Affected

Products:

Uninterruptible

Power

Supply

(UPS)

using

including

Smart-UPS

Symmetra

and

Galaxy

with

Network

Management

Card

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Symmetra

PX

(SYPX)

Network

Management

Card

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Symmetra

PX

kW

UPS

Symmetra

PX

kW

UPS

Gutor

(SXW

GVX)

and

Galaxy

(GVMTS

GVMSA

GVXTS

GVXSA

GFC

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Smart-UPS

Symmetra

and

Galaxy

with

Network

Management

Card

AOS

and

earlier)

APC

Rack

Power

Distribution

Units

(PDU)

using

Metered/Switched

Rack

PDUs

with

embedded

AOS

and

earlier)

APC

Rack

Power

Distribution

Units

(PDU)

using

Metered/Switched

Rack

PDUs

with

embedded

AOS

and

earlier)

APC

Power

Distribution

Products

using

Galaxy

RPP:

AOS

and

earlier)

Network

Management

Card

for

InfraStruxure

kVA

PDU

with

Poles

AOS

and

earlier)

Network

Management

Card

for

InfraStruxure

PDU

(XPDU)

M

AOS

and

earlier)

Network

Management

Card

for

Modular

PDU

(XRDP):

AOS

and

earlier)

Network

Management

Card

for

and

kVA

(PMM):

AOS

and

earlier)

Network

Management

Card

for

Modular

PDU

AOS

and

earlier)

Rack

Automatic

Transfer

Switches

(ATS)

Embedded

Rack

Automatic

Transfer

Switches

AOS

and

earlier)

Network

Management

Card

Cooling

Products:

InRow

Cooling

for

series

and

SKUs

InRow

Cooling

for

series

SKUs

InRow

Cooling

for

series

and

SKUs

InRow

Cooling

Display

for

series

InRow

Cooling

for

series

SKUs

InRow

Cooling

for

series

and

Ecoflair

Air

Economizer

Display

Uniflair

SP

(UNFLRSP)

Uniflair

LE

DX

Perimeter

Cooling

Display

for

SKUs:

IDAV

IDEV

IDWV

IUAV

IUEV

IUWV

IXAV

IXEV

IXWV

LDAV

LDEV

and

LDWV

Refrigerant

Distribution

Unit:

(RDU)

AOS

and

earlier)

Environmental

Monitoring

Unit

with

embedded

NetBotz

AOS

and

earlier)

and

Network

Management

Card

Battery

Management

System

AOS

and

earlier)


A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9 all versions starting from 14.1 before 14.1.4 and all versions starting from 14.2 before 14.2.2 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious Jira API responses


A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability. This affects NetIQ Access Manager 4.5 and 5.0


On BIG-IP version 16.0.x before 16.0.1 15.1.x before 15.1.1 14.1.x before 14.1.2.8 13.1.x before 13.1.3.5 and all 12.1.x versions a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9 all versions starting from 14.1 before 14.1.4 and all versions starting from 14.2 before 14.2.2 allows an attacker to execute arbitrary JavaScript code on the victim's behalf


Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4


Rocket.Chat before 3.11 3.10.5 3.9.7 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.


A

Improper

Neutralization

of

Input

During

Web

Page

Generation

('Cross-site

Scripting')

vulnerability

exists

that

could

cause

script

execution

when

the

request

of

a

privileged

account

accessing

the

vulnerable

web

page

is

intercepted.

Affected

Products:

Uninterruptible

Power

Supply

(UPS)

using

including

Smart-UPS

Symmetra

and

Galaxy

with

Network

Management

Card

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Symmetra

PX

(SYPX)

Network

Management

Card

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Symmetra

PX

kW

UPS

Symmetra

PX

kW

UPS

Gutor

(SXW

GVX)

and

Galaxy

(GVMTS

GVMSA

GVXTS

GVXSA

GFC

AOS

and

earlier)

Uninterruptible

Power

Supply

(UPS)

using

including

Smart-UPS

Symmetra

and

Galaxy

with

Network

Management

Card

AOS

and

earlier)

APC

Rack

Power

Distribution

Units

(PDU)

using

Metered/Switched

Rack

PDUs

with

embedded

AOS

and

earlier)

APC

Rack

Power

Distribution

Units

(PDU)

using

Metered/Switched

Rack

PDUs

with

embedded

AOS

and

earlier)

APC

Power

Distribution

Products

using

Galaxy

RPP:

AOS

and

earlier)

Network

Management

Card

for

InfraStruxure

kVA

PDU

with

Poles

AOS

and

earlier)

Network

Management

Card

for

InfraStruxure

PDU

(XPDU)

M

AOS

and

earlier)

Network

Management

Card

for

Modular

PDU

(XRDP):

AOS

and

earlier)

Network

Management

Card

for

and

kVA

(PMM):

AOS

and

earlier)

Network

Management

Card

for

Modular

PDU

AOS

and

earlier)

Rack

Automatic

Transfer

Switches

(ATS)

Embedded

Rack

Automatic

Transfer

Switches

AOS

and

earlier)

Network

Management

Card

Cooling

Products:

InRow

Cooling

for

series

and

SKUs

InRow

Cooling

for

series

SKUs

InRow

Cooling

for

series

and

SKUs

InRow

Cooling

Display

for

series

InRow

Cooling

for

series

SKUs

InRow

Cooling

for

series

and

Ecoflair

Air

Economizer

Display

Uniflair

SP

(UNFLRSP)

Uniflair

LE

DX

Perimeter

Cooling

Display

for

SKUs:

IDAV

IDEV

IDWV

IUAV

IUEV

IUWV

IXAV

IXEV

IXWV

LDAV

LDEV

and

LDWV

Refrigerant

Distribution

Unit:

(RDU)

AOS

and

earlier)

Environmental

Monitoring

Unit

with

embedded

NetBotz

AOS

and

earlier)

and

Network

Management

Card

Battery

Management

System

AOS

and

earlier)


Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G 38JP_1_11J 38JP_1_11K 38JP_1_11L 38JP_1_26F 38JP_1_26G 38JP_1_26J 38JP_2_03B and 38JP_2_03C) allows a remote unauthenticated attacker to inject an arbitrary script via WebUI of the device.


Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to inject an arbitrary script by executing a specific operation on the management page of EC-CUBE.


IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195767.


IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197503.


Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) and Movable Type Premium 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.


Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) Movable Type 6.8.0 and earlier (Movable Type 6 Series) Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) Movable Type Premium 1.44 and earlier and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.


IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194449.


Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series) Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series) Movable Type 6.7.5 and earlier (Movable Type 6.7 Series) Movable Type Premium 1.39 and earlier and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.


Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) Movable Type 6.8.0 and earlier (Movable Type 6 Series) Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) Movable Type Premium 1.44 and earlier and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.


Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.


Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0 GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0 and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote attacker to inject an arbitrary script by sending a specially crafted request to a specific URL.


IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198231.


A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f d and dir parameters in tce_filemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which if triggered by an administrator could result in the attacker hijacking the victim's session or performing actions on their behalf.


IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194710.


IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195034.


IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198437.


Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacker to inject an arbitrary script by leading a user to a specially crafted page and to perform a specific operation.


A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_filemanager.php with a filename beggining with a period will be rendered as text/html. An attacker with access to tce_filemanager.php could upload a malicious javascript payload which would be triggered when another user views the file.


IBM QRadar User Behavior Analytics 1.0.0 through 4.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199232.


IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195037.


IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194963.


Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier Aterm WG1900HP firmware Ver.2.5.1 and earlier Aterm WG1800HP4 firmware Ver.1.3.1 and earlier Aterm WG1800HP3 firmware Ver.1.5.1 and earlier Aterm WG1200HS2 firmware Ver.2.5.0 and earlier Aterm WG1200HP3 firmware Ver.1.3.1 and earlier Aterm WG1200HP2 firmware Ver.2.5.0 and earlier Aterm W1200EX firmware Ver.1.3.1 and earlier Aterm W1200EX-MS firmware Ver.1.3.1 and earlier Aterm WG1200HS firmware all versions Aterm WG1200HP firmware all versions Aterm WF800HP firmware all versions Aterm WF300HP2 firmware all versions Aterm WR8165N firmware all versions Aterm W500P firmware all versions and Aterm W300P firmware all versions) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.


IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196624.


IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196017.


IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195033.


IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198441.


IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198761.


IBM Security Verify Access Docker 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198661.


Cross-site

scripting

vulnerability

in

Canon

laser

printers

and

small

office

multifunctional

printers

and

sold

in

Japan

imageCLASS

MF

Series

VP

and

and

imageCLASS

LBP

Series

sold

in

the

US

and

iSENSYS

and

and

imageRUNNER

and

sold

in

Europe)

allows

remote

attackers

to

inject

an

arbitrary

script

via

unspecified

vectors.


IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199281.


Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) Movable Type 6.8.0 and earlier (Movable Type 6 Series) Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) Movable Type Premium 1.44 and earlier and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.


Cross-site scripting vulnerability in Create screens of Entry Page and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) Movable Type 6.8.0 and earlier (Movable Type 6 Series) Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) Movable Type Premium 1.44 and earlier and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.


Wekan open source kanban board system between version 3.12 and 4.11 is vulnerable to multiple stored cross-site scripting. This is named 'Fieldbleed' in the vendor's site.


Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series) Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series) Movable Type Premium 1.39 and earlier and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.


IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198572.


IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196620.


IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197666.


Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) Movable Type 6.8.0 and earlier (Movable Type 6 Series) Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) Movable Type Premium 1.44 and earlier and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.


IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195035.


Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result it may lead to an arbitrary script execution on the administrator's web browser.


IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198235.


A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.


A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4. The paths provided in the f d and dir parameters in tce_select_mediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which if triggered by an administrator could result in the attacker hijacking the victim's session or performing actions on their behalf.


Cross-site scripting vulnerability in EC-CUBE Category contents plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.


IBM Sterling Order Management 9.4 9.5 and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199179.


IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198182.


IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194708.


IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199168.


A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_select_mediafile.php with a filename beggining with a period will be rendered as text/html. An attacker with access to tce_select_mediafile.php could upload a malicious javascript payload which would be triggered when another user views the file.


IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199230.


IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195522.


Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series) Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series) Movable Type 6.7.5 and earlier (Movable Type 6.7 Series) Movable Type Premium 1.39 and earlier and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.


A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link granting the attacker javascript execution in the context of the victim's browser.


IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196949.


IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196622.


Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) and Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series)) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.


Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.


IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195357.


IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199246.


IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194451.


IBM Control Desk 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199228.


IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196623.


Cross-site scripting vulnerability in Fudousan plugin ver5.7.0 and earlier Fudousan Plugin Pro Single-User Type ver5.7.0 and earlier and Fudousan Plugin Pro Multi-User Type ver5.7.0 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.


Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.


IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195036.


Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0 GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0 and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote attacker to inject an arbitrary script by sending a specially crafted request to a specific URL.


IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198231.


IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197794.


IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199167.


Reflected cross-site scripting vulnerability in MailForm01 free edition (versions which the last updated date listed at the top of descriptions in the program file is from 2014 December 12 to 2018 July 27) allows a remote attacker to inject an arbitrary script via unspecified vectors.


IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194707.


IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195032.


Cross-site scripting vulnerability in Hitachi Application Server Help (Hitachi Application Server V10 Manual (Windows) version 10-11-01 and earlier and Hitachi Application Server V10 Manual (UNIX) version 10-11-01 and earlier) allows a remote attacker to inject an arbitrary script via unspecified vectors.


Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.


CTparental before 4.45.03 is vulnerable to cross-site scripting (XSS) in the CTparental admin panel. In bl_categires_help.php the 'categories' variable is assigned with the content of the query string param 'cat' without sanitization or encoding enabling an attacker to inject malicious code into the output webpage.


A vulnerability has been identified in RUGGEDCOM ROS M2100 (All versions) RUGGEDCOM ROS M2200 (All versions) RUGGEDCOM ROS M969 (All versions) RUGGEDCOM ROS RMC (All versions) RUGGEDCOM ROS RMC20 (All versions) RUGGEDCOM ROS RMC30 (All versions) RUGGEDCOM ROS RMC40 (All versions) RUGGEDCOM ROS RMC41 (All versions) RUGGEDCOM ROS RMC8388 (All versions < V5.6.0) RUGGEDCOM ROS RP110 (All versions) RUGGEDCOM ROS RS400 (All versions) RUGGEDCOM ROS RS401 (All versions) RUGGEDCOM ROS RS416 (All versions) RUGGEDCOM ROS RS416v2 (All versions < V5.6.0) RUGGEDCOM ROS RS8000 (All versions) RUGGEDCOM ROS RS8000A (All versions) RUGGEDCOM ROS RS8000H (All versions) RUGGEDCOM ROS RS8000T (All versions) RUGGEDCOM ROS RS900 (32M) (All versions < V5.6.0) RUGGEDCOM ROS RS900G (All versions) RUGGEDCOM ROS RS900G (32M) (All versions < V5.6.0) RUGGEDCOM ROS RS900GP (All versions) RUGGEDCOM ROS RS900L (All versions) RUGGEDCOM ROS RS900W (All versions) RUGGEDCOM ROS RS910 (All versions) RUGGEDCOM ROS RS910L (All versions) RUGGEDCOM ROS RS910W (All versions) RUGGEDCOM ROS RS920L (All versions) RUGGEDCOM ROS RS920W (All versions) RUGGEDCOM ROS RS930L (All versions) RUGGEDCOM ROS RS930W (All versions) RUGGEDCOM ROS RS940G (All versions) RUGGEDCOM ROS RS969 (All versions) RUGGEDCOM ROS RSG2100 (All versions) RUGGEDCOM ROS RSG2100 (32M) (All versions < V5.6.0) RUGGEDCOM ROS RSG2100P (All versions) RUGGEDCOM ROS RSG2200 (All versions) RUGGEDCOM ROS RSG2288 (All versions < V5.6.0) RUGGEDCOM ROS RSG2300 (All versions < V5.6.0) RUGGEDCOM ROS RSG2300P (All versions < V5.6.0) RUGGEDCOM ROS RSG2488 (All versions < V5.6.0) RUGGEDCOM ROS RSG907R (All versions < V5.6.0) RUGGEDCOM ROS RSG908C (All versions < V5.6.0) RUGGEDCOM ROS RSG909R (All versions < V5.6.0) RUGGEDCOM ROS RSG910C (All versions < V5.6.0) RUGGEDCOM ROS RSG920P (All versions < V5.6.0) RUGGEDCOM ROS RSL910 (All versions < V5.6.0) RUGGEDCOM ROS RST2228 (All versions < V5.6.0) RUGGEDCOM ROS RST2228P (All versions < V5.6.0) RUGGEDCOM ROS RST916C (All versions < V5.6.0) RUGGEDCOM ROS RST916P (All versions < V5.6.0) RUGGEDCOM ROS i800 (All versions) RUGGEDCOM ROS i801 (All versions) RUGGEDCOM ROS i802 (All versions) RUGGEDCOM ROS i803 (All versions). Improper neutralization of special characters on the web server configuration page could allow an attacker in a privileged position to retrieve sensitive information via cross-site scripting.


A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.


Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting (XSS) attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix Leaf would not escape any strings passed to tags as variables. If an attacker managed to find a variable that was rendered with their unsanitised data they could inject scripts into a generated Leaf page which could enable XSS attacks if other mitigations such as a Content Security Policy were not enabled. This has been patched in 1.3.0. As a workaround sanitize any untrusted input before passing it to Leaf and enable a CSP to block inline script and CSS data.


@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `<table>` a **div** is dynamically created and the clipboard content is copied into its **innerHTML** property without any sanitization resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.