DomainMod cross-site scripting vulnerability (CNVD-2018-10862)

DomainMod is a PHP and MySQL based open source application for managing centrally located domain names and other Internet assets. A cross-site scripting vulnerability exists in DomainMod version 4.10.0. A remote attacker can exploit this vulnerability to execute JavaScript code with the help of t...

HRSALE The Ultimate HRM Cross-Site Scripting Vulnerability

HRSALE The Ultimate HRM is a PHP-based human resource management system. A cross-site scripting vulnerability exists in HRSALE The Ultimate HRM version 1.0.2, which originates from the program failing to validate user-submitted input. A remote attacker can exploit this vulnerability by injecting...

CVE-2018-8720

ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile aka navpage.do, or the Search bar of My Portal aka searchresults.do...

PT-2018-18598

Name of the Vulnerable Software and Affected Versions ServiceNow ITSM version 2016-06-02 Description The issue concerns a cross-site scripting XSS problem. It can be triggered via the First Name or Last Name field of My Profile, or the Search bar of My Portal. Recommendations For version...

Progress Sitefinity Cross-Site Scripting Vulnerability (CNVD-2018-05684)

Progress Sitefinity is an open source platform for building corporate websites and intranets. A cross-site scripting vulnerability exists in Progress Sitefinity version 9.1. The vulnerability can be exploited by remote attackers to inject malicious JavaScript code via the Last name, First name, a...

CVE-2017-18177: Improper Neutralization of Input During Web Page Generation

Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1...

PT-2018-4371

Name of the Vulnerable Software and Affected Versions VirtueMart component versions prior to 3.0.8 for Joomla! Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via specific vectors involving a combinati...

Command injection

FS Lynda Clone has XSS via the keywords parameter to tutorial/ or the editprofilefirstname parameter to user/editprofile...

FS Lynda Clone Cross-Site Scripting Vulnerability

FS Lynda Clone is a video tutorial software developed with jQuery, PHP and MySQL. A cross-site scripting vulnerability exists in FS Lynda Clone. The vulnerability can be exploited to conduct cross-site scripting attacks via the keywords parameter of tutorial/ or the editprofilefirstname parameter...

PT-2017-15088

Name of the Vulnerable Software and Affected Versions FS Lynda Clone affected versions not specified Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the keywords parameter to the "tutorial/" endpoint or the edit profile...

CVE-2017-16819

A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows remote attackers to inject arbitrary JavaScript in the nameFirst aka First Name field for the employee details page /employee.html that is then reflected in multiple pages where...

Legal Robot: Name can't be numbers or email

Hi Team, I observe a strange behaviour in your registration form. When we are making account and entering the first and last name. According to security concerns you should force user to write their first and last names which actually looks like name for example your should force users that the...

Legal Robot: first name and last name restrictions bypass

A security researcher discovered that the maximum lengths of the first name and last name fields were set to 32 characters at registration and 50 characters when using the profile update form. There was no security impact and no sensitive data was compromised. Thanks to @flashdisk for pointing ou...

CVE-2016-4946: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...

PT-2017-8626

Name of the Vulnerable Software and Affected Versions Cloudera HUE versions 3.9.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the First name or Last name field in the HUE Users page, potentially leading to cross-site scripting XSS attacks...

CVE-2016-3670

Cross-site scripting XSS vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field...

CVE-2016-1596

Multiple cross-site scripting XSS vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain 1 user name, 2 tfaClientFirstName, 3 tfaClientLastName, 4 taselectedTopicContent, 5 tforgUnitName, 6...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain 1 user name, 2 tfaClientFirstName, 3 tfaClientLastName, 4 taselectedTopicContent, 5 tforgUnitName, 6...

CubeCart Stored Cross-Site Scripting Vulnerability

CubeCart is an open source PHP e-commerce software system. A stored cross-site scripting vulnerability exists in CubeCart. Due to insufficient filtering of user-supplied data via the "firstname" and "lastname" HTTP POST parameters passed to the "/index.php" script input, a remotely-authenticated...

CubeCart 6.0.10 - Multiple Vulnerabilities

CubeCart 6.0.10 - Multiple Vulnerabilities Advisory ID: HTB23298 Product: CubeCart Vendor: CubeCart Limited Vulnerable Versions: 6.0.10 and probably prior Tested Version: 6.0.10 Advisory Publication: March 2, 2016 without technical details Vendor Notification: March 2, 2016 Vendor Patch: March 16...