CWE-79

Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim’s computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment (e.g. if re-using internal URL’s for deploying, or cookies that are very permissive) private information may be retrieved by the attacker.

In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into user browser via the Web application.

This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remote victim.

Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL query

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.

A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.