7709 matches found
Remote Code Execution (RCE)
symphonycms/symphony-2 is vulnerable to remote code execution RCE. This is due to a lack of sanitization on user input strings, allowing a malicious user to inject and execute arbitrary script through symphony/content/content.blueprintsdatasources.php...
Cross-site Scripting (XSS)
fuelux is vulnerable to cross-site scripting XSS attacks. The library does not sanitise input in the rows in the repeater, allowing a malicious user can execute arbitrary script by using the...
JVN#11326581: Empirical Project Monitor - eXtended vulnerable to cross-site scripting
Empirical Project Monitor - eXtended provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA contains a reflected cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Do not use Empirical Project Monitor - eXtended The...
Cross-site Scripting (XSS)
Semantic-UI is vulnerable to cross-site scripting XSS attacks. When adding the data-text option as a dropdown item, arbitrary script can be executed when a user clicks on the dropdown item...
WordPress BestWebSoft Captcha Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL servers to set up a personal blog site.BestWebSoft Captcha is one of the website back-end CAPTCHA plugin. A cross-site scripting vulnerability exists ...
Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...
Cross-site Scripting (XSS)
plupload is vulnerable to cross-site scripting XSS attacks. The moxie.swf file contains a function that takes in user input and returns a result via a callback endpoint. This can allow a malicious user to inject and execute arbitrary script through a Same Origin Method Execution SOME attack...
Remote Code Execution (RCE) Through YAML Deserialization
Puppet is vulnerable to remote code execution RCE through YAML deserialization. The library extracts facts from POST and will deserialize based on the format a user specifies. This can lead to a malicious user executing arbitrary script during the deserialization if the user allows the YAML forma...
Cross site scripting
Cross-site scripting vulnerability in SOY CMS with installer 1.8.12 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Nextcloud Server Cross-Site Scripting Vulnerability (CNVD-2017-07616)
Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany.Nextcloud Server is one of the server version. A cross-site scripting vulnerability exists in several components of Nextcloud Server. A remote attacker can exploit th...
Zenario Cross-Site Scripting Vulnerability
Zenario is a web-based content management system and multilingual page software. A cross-site scripting vulnerability exists in Zenario version 7.6. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
CVE-2017-2151
Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2017-2135
Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2017-2147
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2017-2140
Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory...
CVE-2017-2140
Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory...
Cross site scripting
Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2017-2140
CVE-2017-2140 affects Tablacus Explorer 17.3.30 and earlier. The root cause is improper handling of directory names, leading to a script injection vulnerability that allows arbitrary scripts to run in the context of the application. Impact stated: when a user accesses a crafted directory, an arbi...
Cross-site Scripting (XSS)
github.com/hashicorp/consul is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the sessionName, sessionMeta and aclName strings, allowing an attacker to inject and execute arbitrary script...