18316 matches found
CVE-2019-15700
The CVE-2019-15700 issue affects public/js/frappe/form/footer/timeline.js in Frappe Framework 12 up to 12.0.8, where HTML is not escaped in the timeline, enabling crafted text such as “changed value of.” Root cause is lack of HTML escaping in that JavaScript file. Public details in connected docu...
CVE-2019-15700
public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text...
CVE-2019-15700: Improper Neutralization of Input During Web Page Generation
public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text...
CVE-2018-18668
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/configformupdate.php cftitle parameter...
CVE-2019-11584
CVE-2019-11584 affects Atlassian Jira versions prior to 8.3.2, where the MigratePriorityScheme resource is vulnerable to a cross-site scripting (XSS) attack via the priority icon URL of an issue priority. Exploitation is remote and, per the public records, may require user interaction; successful...
CVE-2019-15331
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection...
CVE-2019-15331
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection...
Design/Logic Flaw
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection...
CVE-2019-15331
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection...
CVE-2019-15331
The CVE-2019-15331 entry concerns the WordPress plugin wp-support-plus-responsive-ticket-system, affected in all versions prior to 9.1.2. Multiple connected sources confirm a vulnerability described as HTML injection / stored cross-site scripting (XSS) in this plugin. The vulnerability stems from...
Escalation of Privilege in Twistlock
An HTML injection vulnerability has been identified in the Twistlock Console that can lead to a DOM based XSS attack under certain configurations. Ref , CVE-2019-1583 Successful exploitation of this vulnerability allows a Twistlock user with Operator capabilities to escalate privileges to that of...
CVE-2019-15331: Improper Neutralization of Input During Web Page Generation
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection...
Cforms & CformsII <= 15.0.1 - Unauthenticated HTML Injection & CSRF
...
WordPress CformsII plugin <= 15.0.1 - Unauthenticated HTML Injection & Cross-Site Request Forgery (CSRF) vulnerabilities
Unauthenticated HTML Injection & Cross-Site Request Forgery CSRF vulnerabilities found by Jerome Bruandet Nintechnet in WordPress CformsII plugin versions = 15.0.1. Solution Update the WordPress CformsII plugin to the latest available version at least 15.0.2...
CVE-2019-10376: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin...
CVE-2019-10373: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipeline description to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins...
ForeScout Technologies: HTML Injection & Content Spoofing
Summary: The Main Search Box of the site "www.forescout.com" is Vulnerable for HTML Injection & Content Spoofing Steps To Reproduce: 1. Visit example link 2. in The Search Box enter HTML Code test 3. in the Result Page, the HTML code Will be render Impact 1. enter the Next Code In The Search Box...
CVE-2019-11198
Sitecore CMS 9.0.1 and earlier is affected by multiple XSS vulnerabilities. The CVE describes cross-site scripting via nine UI components (List Manager Dashboard, Campaign Creator, Attributes field, Icon Selection, Latitude/Longitude fields, UploadPackage2.aspx, Context menu, Insert from Template...
CVE-2019-10360
A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins...
GigToDo 1.3 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: GigToDo - Freelance Marketplace Script v1.3 Persistent XSS Injection Author: m0ze Vendor Homepage: https://www.gigtodoscript.com Software Link: https://codecanyon.net/item/gigtodo-freelance-marketplace-script/23855397 Version: =...