5084 matches found
Cross site scripting
A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows remote attackers to inject arbitrary JavaScript in the nameFirst aka First Name field for the employee details page /employee.html that is then reflected in multiple pages where...
Cross-site Scripting (XSS)
October CMS is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the brand logo image name, allowing a malicious user to inject and execute arbitrary Javascript...
PT-2017-3710
Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.2.0 through 5.2.11 FortiOS versions 5.4.0 through 5.4.5 FortiOS version 5.6.0 Description: The issue is caused by insufficient protection of the web page structure, allowing a remote attacker to inject arbitrary JavaScript ...
PT-2017-8316
Name of the Vulnerable Software and Affected Versions IBM OpenPages GRC Platform versions 7.1 through 7.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...
Elevation Of Privileges
Apache Cordova In-App-Browser is vulnerable to elevation of privileges through cross-site scripting XSS attacks. The callback identifiers are not correctly validated which allows attackers to execute arbitrary JavaScript within the host page. Using this flaw, the attackers can use a gab-iab to ga...
CVE-2014-0073
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin org.apache.cordova.inappbrowser before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute...
CVE-2014-0073: Undefined Security Weakness
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin org.apache.cordova.inappbrowser before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute...
Cross site scripting
A Cross-Site-Scripting XSS vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary javascript code via webUI "Login Disclaimer" redir parameter...
CVE-2017-7733
A Cross-Site-Scripting XSS vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary javascript code via webUI "Login Disclaimer" redir parameter...
IBM Daeja ViewONE Cross-Site Scripting Vulnerability
IBM Daeja ViewONE is a document viewer from IBM that supports TIFF, PDF and Office-based documents.IBM Daeja ViewONE Virtual, Daeja ViewONE Standard and Daeja ViewONE Professional are its different Daeja ViewONE Virtual, Daeja ViewONE Standard and Daeja ViewONE Professional are different versions...
PT-2017-3711
Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.4.0 through 5.4.5 FortiOS version 5.6.0 Description: A Cross-Site-Scripting XSS vulnerability exists in the webUI "Login Disclaimer" redir parameter, allowing a remote unauthenticated attacker to execute arbitrary javascrip...
Cross-site Scripting (XSS)
mistune is vulnerable to cross-site scripting XSS attacks. These attacks can be conducted by inserting an unexpected newline or by using an email address to execute arbitrary Javascript...
WS-2019-0128
A Cross-Site Scripting vulnerability discovered in ag-grid-community prior to 14.0.0. contents are not properly sanitized and may allow attackers to execute arbitrary JavaScript if user input is rendered in the grid...
IBM Rational Engineering Lifecycle Manager Cross-Site Scripting Vulnerability (CNVD-2017-33351)
IBM Rational Engineering Lifecycle Manager RELM is a suite of engineering lifecycle management software from IBM in the United States. A cross-site scripting vulnerability exists in IBM RELM. A remote attacker can exploit this vulnerability to inject arbitrary JavaScript code into the Web UI...
CVE-2017-9537
Persistent cross-site scripting XSS in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters...
CVE-2017-9537: Improper Neutralization of Input During Web Page Generation
Persistent cross-site scripting XSS in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters...
Cross-site Scripting (XSS)
Wordpress is vulnerable to cross-site scripting XSS attacks. A malicious user can pass a javascript: or data: URL to the link modal to inject and execute arbitrary Javascript...
WS-2017-3779
In Sakai, versions 12.0 through 12.7 are vulnerable to stored Cross-Site Scripting XSS, due to user input not sanitized in Commons' post content, before rendered by the browser when viewing the post. An attacker could run arbitrary javascript code on other users' browsers...
CVE-2015-5181
The CVE-2015-5181 entry concerns Red Hat JBoss A-MQ/JBoss A-MQ Console. The issue is that the JBoss A-MQ console would accept a string containing JavaScript as the name of a new message queue, which leads to remote execution of JavaScript in the console UI. The vulnerability is described in Red H...