Cross-Site Scripting

Overview Versions of ids-enterprise prior to 4.18.2 are vulnerable to Cross-Site Scripting XSS. The soho-dropdown component does not properly encode its output and may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 4.18.2 or later References - GitHub Issue -...

CVE-2018-16623

Kirby CMS version 2.5.12 (CVE-2018-16623) is described in the provided documents as prone to a Persistent XSS via the Title field in the admin panel's Site options dropdown. The issue is consistently reported across CVE records and vendor/third-party sources in the connected documents. The availa...

DRUPAL-CONTRIB-2019-030

This module enables you to create facet-filters for results of a search query and exposes them as blocks The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by two factors. First, an attacker must have...

Facets - Moderately critical - Cross site scripting - SA-CONTRIB-2019-030

This module enables you to create facet-filters for results of a search query and exposes them as blocks The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by two factors. First, an attacker must have...

SugarCRM (SaveDropDown) PHP Code Injection Vulnerability

SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A PHP code...

CVE-2016-9076

An issue where a "" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox 50...

CVE-2016-9076

An issue where a "" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox 50...

CVE-2016-9076

An issue where a "" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox 50...

Zomato: XSS in "explore-keywords-dropdown" results.

It seems that people have exploited this vulnerability before on this website, however, it remains unpatched, so here I am reporting the vulnerability. A XSS vulnerability exists when a restaurant or dish is created with a malicious name. The title of the dish or restaurant is not properly filter...

CVE-2018-9244

GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting specifically, data-milestone-id in the milestone dropdown feature. This is fixed in 10.6.3, 10.5.7, and 10.4.7...

CVE-2018-9244

Removed by vendor...

Popcorn Time 'Subtitles' Dropdown Remote Code Execution Vulnerability

Popcorn Time is an open source movie player that plays HD movies directly from cloud servers via seed files. A remote code execution vulnerability exists in Popcorn Time. An attacker can exploit the vulnerability to execute arbitrary code in an affected system environment, and a failed attack cou...

Cross-site Scripting (XSS)

Semantic-UI is vulnerable to cross-site scripting XSS attacks. When adding the data-text option as a dropdown item, arbitrary script can be executed when a user clicks on the dropdown item...

Harvest: Persistent XSS on ForecastApp

When adding a new Person, by inserting this in First or Last Name, I've got a persistent XSS: The key for this is that the person with the XSS string must appear in one or more dropdown menus. In other words, the Person must be available to be assigned to at least one project. I can also trigger...

CVE-2016-9076

An issue where a "" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox 50...

CVE-2016-9076

An issue where a "" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox 50...

UBUNTU-CVE-2016-9076

An issue where a "" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox 50...

May 3, 2016, update for InfoPath 2013 (KB3114818)

None None...

May 3, 2016, update for InfoPath 2013 (KB3114946)

None None...

DropDown Block 3D - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application DropDown Block 3D published at the 'play' market has multiple vulnerabilities...