1385 matches found
CVE-2018-6355: Improper Neutralization of Input During Web Page Generation
/goform/setLang on iBall 300M devices with "iB-WRB302N1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the lang parameter...
PT-2018-17498
Name of the Vulnerable Software and Affected Versions iBall 300M version iB-WRB302N 1.0.1-Sep 8 2017 Description The issue concerns an Unauthenticated Stored Cross Site Scripting vulnerability. It is exploited via the lang parameter in the "/goform/setLang" API endpoint. Recommendations For versi...
CVE-2018-5369
The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a langidentificator parameter...
PT-2018-16926
Name of the Vulnerable Software and Affected Versions SrbTransLatin plugin version 1.46 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved by sending a specific request to the "wp-admin/options-general.php" endpoint with a lang...
myheritage.com XSS vulnerability
Open Bug Bounty ID: OBB-457329 Description| Value ---|--- Affected Website:| myheritage.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...
CVE-2017-17431
GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761, CVE-2017-14762, or CVE-2017-14765...
PT-2017-14776
GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761, CVE-2017-14762, or CVE-2017-14765...
CVE-2017-17431: Improper Neutralization of Input During Web Page Generation
GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761, CVE-2017-14762, or CVE-2017-14765...
CVE-2017-17093
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...
CVE-2017-17093
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...
CVE-2017-17093
CVE-2017-17093 affects WordPress prior to 4.9.1, specifically wp-includes/general-template.php where the lang attribute of an HTML element is not properly restricted. This design flaw can enable cross-site scripting (XSS) via the site language setting. The vulnerability is addressed by WordPress ...
CVE-2017-17093
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...
CVE-2017-17093
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...
CVE-2017-17093: Improper Neutralization of Input During Web Page Generation
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...
PT-2017-14708
Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.1 Description The issue is related to the lang attribute of an HTML element in the wp-includes/general-template.php file, which does not have proper restrictions. This might allow attackers to conduct cross-site...
Ruby Psych::Emitter start_document Heap Overflow Vulnerability(CVE-2016-2338)
DESCRIPTION An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase...
var.astro.cz XSS vulnerability
Open Bug Bounty ID: OBB-311805 Description| Value ---|--- Affected Website:| var.astro.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
SQL Injection
dolibarr is susceptible to SQL injection attacks. The attacker can execute arbitrary SQL queries through the style.css.php and translate.class.php files because the library does not filter the lang and defaultlang attributes respectively...
callens-fg.be XSS vulnerability
Open Bug Bounty ID: OBB-284037 Description| Value ---|--- Affected Website:| callens-fg.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...