UBUNTU-CVE-2016-6191

Multiple cross-site scripting XSS vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 Description, 2 Location, 3 URL, or 4 Title field...

User Picker Custom field HTML tags showing when creating new issues

h3. Summary Customer reported that when creating custom field User Picker and added html tags in description field, text link shows correctly in Custom Field screen under Administration Setting. However when creating new issues, the create issue form for User Picker field shows the HTML code not...

CVE-2014-9580

Cross-site scripting XSS vulnerability in ProjectSend formerly cFTP r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload. NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information...

CVE-2014-9580

CVE-2014-9580 concerns a Cross-site scripting (XSS) flaw in ProjectSend (formerly cFTP) version r561. The vulnerability enables remote attackers to inject arbitrary web script or HTML via the Description field of a file upload. This is the concrete, described impact: execution of injected scripts...

CVE-2014-9580: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ProjectSend formerly cFTP r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload. NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information...

PT-2015-4290

Name of the Vulnerable Software and Affected Versions ProjectSend formerly cFTP version r561 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload. Recommendations For version r561, update to a versio...

CVE-2014-7146

The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted 1 description field or 2 issuelink attribute in an XML file, which is not properly handled when executing the pregreplace function with the e modifier...

MantisBT XmlImportExport Plugin PHP Code Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability', 'Description' = %q This module exploits a post-auth vulnerability...

PT-2014-7806

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.17 and earlier Description The issue allows remote attackers to execute arbitrary PHP code via a crafted description field or issuelink attribute in an XML file. This is due to improper handling when executing the preg...

CVE-2014-7146: Improper Input Validation

The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted 1 description field or 2 issuelink attribute in an XML file, which is not properly handled when executing the pregreplace function with the e modifier...

CVE-2014-8954: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpSound 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 Title or 2 Description fields in a playlist or the 3 filter parameter in an explore action to index.php...

jenkins: default markup formatter permits offsite-bound forms (SECURITY-88)

Cross-site scripting XSS vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management...

CVE-2014-0914

Cross-site scripting XSS vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management...

PT-2014-3942

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 6.2 through 6.2.8 IBM Maximo Asset Management versions 6.x and 7.x through 7.5.0.6 IBM Maximo Asset Management versions 7.5 through 7.5.0.3 IBM Maximo Asset Management versions 7.5.1 through 7.5.1.2 IBM...

CVE-2014-0914: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management...

network tracker .95 - Stored XSS

No description provided by source. Exploit Title: Network Tracker .95 Stored XSS Date: 08-18-2011 Author: G13 Software link: http://networktracker.org/ Version: .95 ISSUE The application contains a option which allows anyone to create a user. If this option is left enabled an attacker could launc...

openstack-horizon: XSS in Horizon orchestration dashboard when using a malicious template

Cross-site scripting XSS vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard aka Horizon 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template...

CVE-2014-0157

Cross-site scripting XSS vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard aka Horizon 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template...

CVE-2014-0157: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard aka Horizon 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template...