PT-2017-9896

Name of the Vulnerable Software and Affected Versions IBM Emptoris Strategic Supply Management Platform versions 10.0.0.x through 10.1.1.x Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credential...

CVE-2016-8950

IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 11883...

PT-2017-12961

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server versions 9.1, 11.3, and 11.5 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

CVE-2017-1208

IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

PT-2017-12378

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 8.5 through 9.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2017-12342

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.1 through 7.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

Elastic Kibana Cross Site Scripting Vulnerability (Jul 2017)

Elastic Kibana is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-1000220: Improper Neutralization of Input During Web Page Generation

Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers...

PT-2017-7671

Name of the Vulnerable Software and Affected Versions Kibana versions prior to 4.5.4 Kibana versions prior to 4.1.11 Description The issue allows an attacker to execute arbitrary JavaScript in users' browsers through an XSS attack. Recommendations For versions prior to 4.5.4, update to version...

CVE-2017-9419

Cross-site scripting XSS vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter...

CVE-2016-9973

IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120209...

Cross site scripting

Cross site scripting XSS vulnerability in pages.editform.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATHINFO in an acp.php URL, due to use of unsanitized $SERVER'PHPSELF' to generate URLs...

CVE-2017-9420

Cross site scripting XSS vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter...

CVE-2017-9420

Cross site scripting XSS vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter...

PT-2017-18830

Name of the Vulnerable Software and Affected Versions Hitachi Device Manager versions prior to 8.5.2-01 Hitachi Replication Manager versions prior to 8.5.2-00 Description A cross-site scripting issue allows authenticated remote users to execute arbitrary JavaScript code. Recommendations For Hitac...

Apple WebKit / Safari 10.0.3(12602.4.8) - 'Editor::Command::execute' Universal Cross-Site Scripting

document-updateLayoutIgnorePendingStylesheets; return mcommand-executemframe, triggeringEvent, msource, parameter; This method is invoked under an |EventQueueScope|. But |updateLayoutIgnorePendingStylesheets| invokes |MediaQueryMatcher::styleResolverChanged| that directly calls |handleEvent| not...

Cross site scripting

IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125732...

PT-2017-12710

Name of the Vulnerable Software and Affected Versions IBM Content Navigator & CMIS versions 2.0 through 3.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

Cross-Site Scripting (XSS)

atlas-dashboardv2 is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the user input in the edit-tag function, allowing a malicious user to inject and execute arbitrary javascript...