WP Live Chat Support Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on servers running PHP and MySQL.WP Live Chat Support is one of the components that supports live chat. A cross-site scripting vulnerability exists...

PT-2018-16818

Name of the Vulnerable Software and Affected Versions Atlassian Application Links version 5.4.3 and earlier Description The issue allows remote attackers with administration rights to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the display url of a configur...

IBM WebSphere Portal Cross-Site Scripting Vulnerability (CNVD-2018-08589)

IBM WebSphere Portal is a suite of enterprise portal software from IBM. The software creates a platform that connects an organization internally and externally, allowing employees, customers and suppliers to access internal data through the platform. A cross-site scripting vulnerability exists in...

CVE-2017-18097: Improper Neutralization of Input During Web Page Generation

The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the title of a Trello card...

CVE-2017-18098: Improper Neutralization of Input During Web Page Generation

The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through various fields...

CVE-2018-7035

Cross-site scripting XSS vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers users to inject JavaScript via HTML content in an editor, which will result in Stored XSS when an Administrator tries to edit the same content, as demonstrated by use of the source editor for HTML mode ...

CVE-2018-7035

CVE-2018-7035 describes a Stored XSS in Gleez CMS (versions 1.2.0 and 2.0) where an attacker can inject JavaScript via HTML content in an editor. The issue is demonstrated when using the source editor in HTML mode during Add Blog, leading to Stored XSS when an Administrator edits the content. The...

PT-2018-12215

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager version 8.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

CVE-2018-1188

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and versions 7.2.1.x is affected by a cross-site scripting vulnerability in the Authorization Providers page within the OneFS web administration interface. A malicious administrator may potentially injec...

CVE-2018-1202: Improper Neutralization of Input During Web Page Generation

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the NDMP Page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or...

CVE-2018-1187: Improper Neutralization of Input During Web Page Generation

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6 is affected by a cross-site scripting vulnerability in the Network Configuration page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or...

PT-2018-10942

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon versions 7.1.1.11 Dell EMC Isilon versions 7.2.1.x Dell EMC Isilon versions 8.0.0.0 through 8.0.0.6 Dell EMC Isilon versions 8.0.1.0 through 8.0.1.2 Dell EMC Isilon versions 8.1.0.0 through 8.1.0.1 Description The issue is...

CVE-2018-1201: Improper Neutralization of Input During Web Page Generation

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Job Operations Page within the OneFS web administration interface. A malicious administrator may...

PT-2018-12405

Name of the Vulnerable Software and Affected Versions IBM MQ Appliance versions 9.0.1 through 9.0.4 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2018-6264

Name of the Vulnerable Software and Affected Versions: IBM Jazz Foundation versions 5.0 through 6.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

Wicket jQuery UI WYSIWYG Editor Vulnerability

Wicket jQuery UI is an API that provides all the jQuery UI integration . WYSIWYG editor is one of the editors . A security vulnerability exists in the WYSIWYG editor in Wicket jQuery UI versions 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier. An attacker can exploit the...

PT-2018-2635

Name of the Vulnerable Software and Affected Versions Sanitize gem for Ruby versions prior to 4.6.3 Description The issue is related to errors in input data checking in the Sanitize library for Ruby. It can be exploited by a remote attacker to bypass restrictions on the use of HTML attributes,...

Kontena server/app/views/static/code.html page cross-site scripting vulnerability

Kontena is a suite of open source microservices platforms capable of running applications as containers. The 'kontena master login --remote' code on the server/app/views/static/code.html page in Kontena versions prior to 1.5.0 indicates a cross-site scripting vulnerability. A remote attacker coul...

HTML injection/XSS in Sanitize

When Sanitize gem is used in combination with libxml2 = 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS...

CVE-2018-8737

Bookme Control Panel 2.0 Application is vulnerable to stored XSS within the Customers "Book Me" function. Within the Name and Note aka custName and custNote sections of the Customers screen, the application does not sanitize user-supplied input and renders injected JavaScript code to the user's...