2019

Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Activity G

Vulnerability in the Siebel Core - Server Framework component of Oracle Siebel CRM (subcomponent: Search). Supported ver

Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: HT

hisiphp 1.0.8 is affected by: Cross Site Scripting (XSS).

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir

Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a

Cross-site scripting vulnerability in Central Dogma 0.17.0 to 0.40.1 allows remote attackers to inject arbitrary web scr

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is possible to in

A cross-site scripting (XSS) vulnerability in getPagingStart() in core/lists/PAGING.php in WIKINDX before 5.8.2 allows r

In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user

A cross-site scripting (XSS) vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier

An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Cr

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Cr

EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document

EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malic

An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject ma

Misskey before 10.102.4 allows hijacking a user's token.

ASH-AIO before 2.0.0.3 allows an open redirect.

invenio-previewer before 1.0.0a12 allows XSS.

invenio-app before 1.1.1 allows host header injection.

stacktable.js before 1.0.4 allows XSS.

edx-platform before 2015-09-17 allows XSS via a team name.

Planon before Live Build 41 has XSS.

cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).

cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).

cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).

edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.

Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted f

A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potenti

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication

cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).

cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).

Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to

cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400).

cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).

cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357).

cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372).

cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373).

cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-374).

cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action (SEC-375).

cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376).

cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377).

TestLink 1.9.19 has XSS via the error.php message parameter.

Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.

cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391).