ownCloud Desktop Client Local Command Injection Vulnerability

The ownCloud Desktop Client is a desktop client for connecting to OwnCloud servers. The ownCloud Desktop Client local command injection vulnerability allows an attacker to exploit the vulnerability to execute arbitrary script code in the context of an affected application...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2016-06713)

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, etc. and supports free switching among three languages Chinese, Japanese, and English. A cross-site scripting vulnerability exists in...

simple chat vulnerable to cross-site scripting

Overview simple chat provided by Let's PHP! contains a cross-site scripting vulnerability CWE-79. Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary...

ClipBucket cross-site scripting vulnerability (CNVD-2016-06481)

ClipBucket is an open source video sharing software developed by Arslan team. The software allows you to share videos to video sites and supports the lights off effect when watching a movie. ClipBucket suffers from a cross-site scripting vulnerability. Because the program fails to properly filter...

Geeklog IVYWE edition contains a cross-site scripting vulnerability

Overview Geeklog is an open source content management system CMS. Geeklog IVYWE edition contains a cross-site scripting CWE-79 vulnerability. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

ClipBucket vulnerable to cross-site scripting

Overview Clipbucket is open source video sharing script. ClipBucket contains a cross-site scripting CWE-79 vulnerability. Yoshinori Matsumoto of Kobe Digital Labo, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnershi...

Cisco Identity Services Engine Admin Dashboard Page Cross-Site Scripting Vulnerability

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A cross-site scripting...

Cisco Smart Call Home Transport Gateway Cross-Site Scripting Vulnerability

A vulnerability in the web framework of the Cisco Smart Call Home Transport Gateway could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of a user-supplied value. An attacker could exploit this...

WordPress plugin Google Maps 'id' parameter cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Google Maps 'id' parameter due to the...

Foreman HTML Injection Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. An HTML injection vulnerability exists in Foreman, which arises from the program's failure to adequately...

Cisco IP Phone 8800 Series XSS Vulnerability (cisco-sa-20160810-ip-phone-8800)

Cisco IP Phone 8800 Series are prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if descriptio...

CVE-2016-6634

Cross-site scripting XSS vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-3196

Cross-site scripting XSS vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section...

Fotoware Fotoweb Cross-site Scripting Vulnerability

Fotoware Fotoweb is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Huge-IT Portfolio Gallery manager cross-site scripting vulnerability

Huge-IT Portfolio Gallery manager is Huge-IT team developed an extension plugin for Joomla! in the management and display of photos, videos and so on. A cross-site scripting vulnerability exists in Huge-IT Portfolio Gallery manager v1.1.5. An attacker can exploit this vulnerability to inject...

Multiple Vulnerabilities in Cube Digital Media Neoscreen

The Cube Digital Media Neoscreen is a smart display from the French company Cube Digital Media. A security vulnerability exists in Cube Digital Media Neoscreen version 4.5. An attacker can exploit this vulnerability to execute arbitrary script code in the context of an affected site, steal...

Huawei ISM Professional Cross-Site Scripting Vulnerability

Huawei ISM is a suite of device management software, cloud storage management software, and network storage management software from Huawei, China.Huawei ISM Professional is the professional version of Huawei ISM. A cross-site scripting vulnerability exists in Huawei ISM Professional that...

WordPress WP Advanced Comment Plugin HTML Injection Vulnerability

WordPress is a suite of blogging platforms developed in the PHP language by the WordPress Software Foundation.WP Advanced Comment is one of the Ajax-based comment plugins. An HTML injection vulnerability exists in the WordPress WP Advanced Comment plugin. An attacker can exploit this vulnerabilit...

WordPress Live Chat Support Plugin HTML Injection Vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Software Foundation.Live Chat Support is one of the chat plugins. An HTML injection vulnerability exists in versions of the WordPress Live Chat Support plugin prior to 6.2.02, which can be exploited by an attacker to run arbitrary...

Fiyo CMS Cross-Site Scripting Vulnerability

Fiyo CMS is a content management system CMS for creating CMS templates. A cross-site scripting vulnerability exists in Fiyo CMS version 2.0.6.1, which can be exploited by an attacker to inject arbitrary web script or HTML...