Mario Tesoro

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.

An issue exists where the `refreshView()` function writes HTML from `ngModel` or reactive form controls directly to `innerHTML` without using `DomSanitizer`. This bypasses the default sanitize option, allowing attackers to store HTML containing event-handler attributes. When this content is subsequently loaded into the editor, it can lead to the execution of arbitrary scripts within the application origin for users who open the affected content.

A stored cross-site scripting (XSS) issue exists in HCL Unica Marketing Operations. Stored cross-site scripting occurs when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.

A Cross-Site Request Forgery (CSRF) issue exists in OpenText Web Site Management Server. A user with an active session could be tricked into performing actions without their knowledge by clicking on a malicious page containing crafted HTML.

The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to Reflected Cross-site Scripting (XSS). This allows for the injection of malicious JavaScript code through URL parameters. When a page preview is rendered, the injected script can execute on the client side. The issue involves rendering malicious scripts when a page preview is generated.

A Cross Site Scripting issue exists in DokuWiki. A remote attacker may be able to execute arbitrary code through the `q` parameter. The vulnerable component is 'Librarian' [56.1].

IBM Copy Services Manager 6.3.13 is susceptible to cross-site scripting. An authenticated user can embed arbitrary JavaScript code within the Web UI, potentially altering functionality and leading to credentials disclosure within a trusted session.

The issue allows an attacker to access sensitive files by inserting path traversal payloads inside the `deficon` parameter, enabling local file inclusion.