Cross site scripting

The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML ...

CVE-2018-5229: Improper Neutralization of Input During Web Page Generation

The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of user submitted add-on names...

WordPress Product Enquiry for WooCommerce Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Product Enquiry for WooCommerce plugin, which can be exploited b...

Code injection

Code Injection vulnerability in the ePolicy Orchestrator ePO extension in McAfee Threat Intelligence Exchange TIE Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector...

CVE-2017-3907: Improper Control of Generation of Code

Code Injection vulnerability in the ePolicy Orchestrator ePO extension in McAfee Threat Intelligence Exchange TIE Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector...

PT-2018-7283

Name of the Vulnerable Software and Affected Versions: McAfee Threat Intelligence Exchange TIE Server versions 2.1.0 and earlier Description: A Code Injection issue in the ePolicy Orchestrator ePO extension allows remote attackers to execute arbitrary HTML code, which is then reflected in the...

Symphony CMS <= 2.7.6 XSS Vulnerability

Symphony CMS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2018-11552

There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON-Auto-Dialer-Agents-Name" field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable applicati...

Cross-site Scripting (XSS)

cucumber is vulnerable to cross-site scripting XSS attacks. The HTML formatter appends any scenario output without sanitization, allowing a malicious user to inject and execute arbitrary HTML code...

CVE-2017-3961

Cross-Site Scripting XSS vulnerability in the web interface in McAfee Network Security Management NSM before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes...

CVE-2018-0576: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-10371

An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser via a pag...

WordPress Catapult UK Cookie Consent Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports the setting up of personal blog sites on servers with PHP and MySQL.Catapult UK Cookie Consent is a plugin used to add a cached notification bar to a website. A cross-site...

CVE-2018-10310: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary HTML/script code in the context of a victim's browser...

PT-2018-18649

Name of the Vulnerable Software and Affected Versions Kodi versions through 17.6 Description A Persistent XSS issue exists that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist. Recommendations For versions through 17.6, update to a...

KYOCERA Net Admin 3.4 Multiple XSS Vulnerabilities

Summary KYOCERA Net Admin is Kyocera's unified device management software that uses a web-based platform to give network administrators easy and uncomplicated control to handle a fleet for up to 10,000 devices. Tasks that used to require multiple programs or walking to each printer can now be...

CVE-2017-18098

The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through various fields...

PT-2018-11125

Name of the Vulnerable Software and Affected Versions RSA Authentication Agent versions 8.0.1 and earlier for Web for both IIS and Apache Web Server Description The issue allows attackers to execute arbitrary HTML or JavaScript code in the user's browser session, potentially leading to the...

CVE-2018-1233: Improper Neutralization of Input During Web Page Generation

RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnerability. The attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context ...

CVE-2018-1201: Improper Neutralization of Input During Web Page Generation

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Job Operations Page within the OneFS web administration interface. A malicious administrator may...