Cross-site Scripting (XSS)

github.com/fabiolb/fabio is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the value of path and val in admin/ui/manual.go are not sanitized and can be used to inject arbitary Javascript into a victim's browser...

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...

KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vulnerability

KeystoneJS version 4.0.0-beta.5 suffers from an unauthenticated CSV injection vulnerability in admin/server/api/download.js and lib/list/getCSVData.js Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contac...

ForgeRock OpenIDM Admin UI Cross-Site Scripting Vulnerability (CNVD-2017-30829)

ForgeRock OpenIDM is an extensible set of identity management tools for managing identity lifecycle and provisioning issues. A cross-site scripting vulnerability in the ForgeRock OpenIDM Admin UI allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which c...

CVE-2017-7591

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting XSS attacks within the Admin UI, as demonstrated by the sortKeys parameter to the authzRoles script under managed/user/...

Cross site scripting

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting XSS attacks within the Admin UI, as demonstrated by the sortKeys parameter to the authzRoles script under managed/user/...

Cross site scripting

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting XSS attacks within the Admin UI, as demonstrated by a crafted Managed Object Name...

CVE-2017-7590

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting XSS attacks within the Admin UI, as demonstrated by a crafted Managed Object Name...

CVE-2017-7590

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting XSS attacks within the Admin UI, as demonstrated by a crafted Managed Object Name...

CVE-2017-7591

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting XSS attacks within the Admin UI, as demonstrated by the sortKeys parameter to the authzRoles script under managed/user/...

CVE-2017-7591

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting XSS attacks within the Admin UI, as demonstrated by the sortKeys parameter to the authzRoles script under managed/user/...

CVE-2017-7590

ForgeRock OpenIDM Admin UI (versions 4.0.0 and 4.5.0) is vulnerable to persistent cross-site scripting (XSS) via a crafted Managed Object Name, allowing script injection in the Admin UI. This label is supported by multiple sources (NVD/CVE-2017-7590 description; CNVD-2017-30828; OSV/PRION entries...

CVE-2017-7591

OpenIDM versions 4.0.0 and 4.5.0 are affected by a reflected cross-site scripting (XSS) vulnerability in the Admin UI, reachable via the _sortKeys parameter to the authzRoles script under managed/user/. The root cause is an reflected XSS in the Admin UI input handling, enabling an attacker-suppli...

CVE-2017-7590

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting XSS attacks within the Admin UI, as demonstrated by a crafted Managed Object Name...

CVE-2017-7590: Improper Neutralization of Input During Web Page Generation

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting XSS attacks within the Admin UI, as demonstrated by a crafted Managed Object Name...

PT-2017-17822

Name of the Vulnerable Software and Affected Versions OpenIDM versions prior to 4.0.1 and 4.5.1 Description The issue allows for reflected cross-site scripting XSS attacks within the Admin UI. This can be demonstrated by exploiting the sortKeys parameter to the authzRoles script under the...

CVE-2017-7591: Improper Neutralization of Input During Web Page Generation

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting XSS attacks within the Admin UI, as demonstrated by the sortKeys parameter to the authzRoles script under managed/user/...

PT-2017-17821

Name of the Vulnerable Software and Affected Versions OpenIDM versions prior to 4.0.0 and 4.5.0 Description The issue allows for persistent cross-site scripting XSS attacks within the Admin UI. This can be achieved by crafting a Managed Object Name. Recommendations For versions prior to 4.0.0 and...

CVE-2016-0733

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...

CVE-2016-0733

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...