CVE-2018-1000416

A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access...

PT-2019-8737

Name of the Vulnerable Software and Affected Versions Jenkins Git Changelog Plugin versions 2.6 and earlier Description A cross-site scripting issue exists that allows attackers to control the Git history parsed by the plugin, enabling them to have Jenkins render arbitrary HTML on some pages. Thi...

CVE-2018-1000413: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins...

CVE-2018-1000407: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins...

Multiple Cross-Site Scripting Vulnerabilities in ImpressCMS

ImpressCMS is a popular content management system. Multiple cross-site scripting vulnerabilities exist in ImpressCMS. An attacker can exploit the vulnerabilities to execute arbitrary HTML and script code in an administrator's browser session in the context of an affected site...

XSS in the labels widget gadget - CVE-2018-20232

The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the rendering of retrieved content from a url location that could be...

PT-2018-2743

Name of the Vulnerable Software and Affected Versions Dr.Web Enterprise Security Suite affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the "Security Control Center" component. This allows a remote attacker to execute arbitrary...

PT-2018-2745

Name of the Vulnerable Software and Affected Versions Dr.Web Enterprise Security Suite affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the "Центр управления безопасностью" component. This could allow a remote attacker to execu...

PT-2018-2744

Name of the Vulnerable Software and Affected Versions Dr.Web Enterprise Security Suite affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the "Security Control Center" component. This could allow a remote attacker to execute...

CVE-2018-19047

mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a 'img src="http://192.168' substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating "If you allow users to pass HT...

CVE-2018-19047

mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a 'img src="http://192.168' substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating "If you allow users to pass HT...

PT-2018-14766 · Mpdf · Mpdf

Name of the Vulnerable Software and Affected Versions: mPDF versions prior to 7.1.7 Description: The issue allows for Server-Side Request Forgery SSRF if mPDF is deployed as a web application that accepts arbitrary HTML. This can be demonstrated by an substring that triggers a call to getImage in...

CVE-2018-19047: Server-Side Request Forgery (SSRF)

mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '...

Shopify: H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_maps

Description: The /:id/sandbox/googlemaps and /:id/sandbox/googleautocomplete routes on checkout.shopify.com are used to render the Google Map on the "Order Status" page as well as the address prediction on checkout pages. The page performs origin validation on incoming postMessages making sure th...

PT-2018-11797

Name of the Vulnerable Software and Affected Versions Atlassian Jira versions 7.6.7 and earlier Atlassian Jira versions 7.7.0 through 7.7.4 Atlassian Jira versions 7.8.0 through 7.8.4 Atlassian Jira versions 7.9.0 through 7.9.2 Atlassian Jira versions 7.10.0 through 7.10.2 Atlassian Jira version...

Apache ActiveMQ Cross-Site Scripting Vulnerability (CNVD-2018-16203)

Apache ActiveMQ is an open source message broker that can be used as an intermediary to communicate data between other software. A cross-site scripting vulnerability exists in Apache ActiveMQ, which can be exploited by remote attackers to inject arbitrary web script or HTML...

CVE-2018-13392

Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in linked issue keys...

PT-2018-11794

Name of the Vulnerable Software and Affected Versions Atlassian Fisheye and Crucible versions prior to 4.6.0 Description The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in linked issue keys. Recommendations For versions prior t...

CVE-2018-6681

Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management NSM 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface...

Cross site scripting

The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML ...