CVE Vulnerability

CWE-79

CVE-2018-12625

by

An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter.

CVE-2018-12626

by

An issue was discovered in Eventum 3.5.0. /htdocs/popup.php has XSS via the cat parameter.

CVE-2018-12627

by

An issue was discovered in Eventum 3.5.0. /htdocs/list.php has XSS via the show_notification_list_issues or show_authorized_issues parameter.

CVE-2018-12638

by

An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input validation of the device name. A malicious device name can execute JavaScript on the registered Bose User Account if a speaker has been connected to the app.

CVE-2018-12650

by

Adrenalin HRMS version 5.4.0 contains a Reflected Cross Site Scripting (XSS) vulnerability in the ApplicationtEmployeeSearch page via ‘prntDDLCntrlName’ and ‘prntFrmName’.

CVE-2018-12651

by

A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the ShiftEmployeeSearch.aspx prntFrmName or prntDDLCntrlName parameter.