CVE-2017-1000144: Improper Neutralization of Input During Web Page Generation

Mahara 1.9 before 1.9.6 and 1.10 before 1.10.4 and 15.04 before 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javascript into an institution display name, which will be displayed to other users unescaped on some Mahara system pages...

IBM Rational DOORS Next Generation Cross-Site Scripting Vulnerability

IBM Rational DOORS Next Generation RDNG is a suite of software for capturing, tracking, analyzing, and managing requirements from IBM in the United States. The software provides a single platform for global team collaboration to manage requirements more efficiently, sharing unified users, servers...

PT-2017-8316

Name of the Vulnerable Software and Affected Versions IBM OpenPages GRC Platform versions 7.1 through 7.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

PT-2017-13904

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager for Lifecycle/Power/Patch Platform and Applications versions 9.2 through 9.5 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially...

IBM Rational Team Concert Cross-Site Scripting Vulnerability (CNVD-2017-32842)

IBM Rational Team Concert RTC is the U.S. IBM's set of Jazz-based platform and support decentralized teams for real-time collaboration related to software lifecycle management solutions. A cross-site scripting vulnerability exists in IBM RTC versions 4.0 through 4.0.7, 5.0 through 5.0.2, and 6.0...

cpmstar.com XSS vulnerability

Open Bug Bounty ID: OBB-367745 Description| Value ---|--- Affected Website:| cpmstar.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

PT-2017-12179

Name of the Vulnerable Software and Affected Versions IBM DOORS next Generation DNG/RRC affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within...

PT-2017-12993

Name of the Vulnerable Software and Affected Versions IBM Team Concert RTC affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted...

IBM Daeja ViewONE Cross-Site Scripting Vulnerability (CNVD-2017-34484)

IBM Daeja ViewONE is a document viewer from IBM that supports TIFF, PDF and Office-based documents.IBM Daeja ViewONE Virtual, Daeja ViewONE Standard and Daeja ViewONE Professional are its different Daeja ViewONE Virtual, Daeja ViewONE Standard and Daeja ViewONE Professional are different versions...

PT-2017-12143

Name of the Vulnerable Software and Affected Versions IBM Jazz Foundation affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

Rate Me Cross-Site Scripting Vulnerability

Rate Me is a rating script written in PHP. A cross-site scripting vulnerability exists in the rate-me.php file in Rate Me version 1.0. A remote attacker can exploit this vulnerability to inject JavaScript code...

Juniper Junos Space HTML Injection Vulnerability

Juniper Junos Space is a network management solution from Juniper Networks. The solution supports automated configuration, monitoring and troubleshooting of devices and services throughout their lifecycle. An HTML injection vulnerability exists in Juniper Junos Space versions prior to 17.1R1. A...

CVE-2017-15538

Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php...

Atlassian FishEye and Crucible Cross-Site Scripting Vulnerabilities

Atlassian FishEye and Crucible are both products of the Australian company Atlassian, FishEye is a suite of software for deep viewing of source code repositories and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in the administration user deletion resource ...

PT-2017-11408

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 17.1R1 Description A persistent site scripting issue in Juniper Networks Junos Space enables users who can modify specific configurations to inject malicious Javascript or HTML. This can lead to...

austinschools.org XSS vulnerability

Vulnerable URL: http://www.austinschools.org/it/flashdetection.swf?flashContentURL=javascript:alert1 Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 11.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1164964 VI...

Cross-site Scripting (XSS)

loofah is vulnerable to cross-site scripting XSS attacks. The library is does not properly sanitize nested script tags, allowing a malicious user to inject and execute arbitrary Javascript...

CVE-2017-15214

Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges and also to execute JavaScript against other users including unauthenticated users, via the name, title, or id parameter to...

CVE-2017-15215

Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator, an attacker can for example take over the admin session or change global settings or add/delete links. It is also...

CVE-2017-15214

Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges and also to execute JavaScript against other users including unauthenticated users, via the name, title, or id parameter to...