18318 matches found
CVE-2019-10336: Improper Neutralization of Input During Web Page Generation
A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin...
XSS vulnerability in electricflow affecting job configuration forms
The configuration forms of various post-build steps contributed by electricflow were vulnerable to cross-site scripting. This allowed attackers able to control the output of connected ElectricFlow servers' APIs to inject arbitrary HTML and JavaScript into the configuration form. electricflow no...
CVE-2019-10226
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is a XSS protection...
CVE-2019-10226
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is a XSS protection...
Design/Logic Flaw
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is a XSS protection...
CVE-2019-10226: Improper Neutralization of Input During Web Page Generation
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is a XSS protection...
CVE-2019-10226
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is a XSS protection...
PT-2019-11643 · Fat Free Crm · Fat Free Crm
Name of the Vulnerable Software and Affected Versions: Fat Free CRM version 0.19.0 Description: A HTML Injection issue has been reported in the Fat Free CRM product, specifically via an authenticated request to the "/comments" URI. The vendor disputes the significance of this report, citing that...
CVE-2019-10226
CVE-2019-10226 concerns HTML Injection in Fat Free CRM 0.19.0 via an authenticated request to /comments. Public documentation notes that the vendor disputed the severity, citing that some HTML formatting is allowed and that there is an XSS protection mechanism. Subsequent entries (GHSA and OSV mi...
CVE-2018-8047
vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...
Shopify: HTML injection in https://interviewing.shopify.com/index.php?candidate=
https://interviewing.shopify.com/index.php?candidate= is inserting the value of candidate into the DOM without any filtering except that the equal sign can't appear in the payload, this allows attacker to injection any html in the DOM. Of course reflected XSS payloads like ...something... will be...
dotCMS 5.1.1 Open Redirection / Cross Site Scripting
Read full vulnerability report @ https://secureli.com/dotcms-v5-1-1-open-redirect-vulnerability/ dotCMS v5.1.1 suffers from an Open Redirect Vulnerability, in addition to many other vulnerabilities that I am still verifying. The following URL is a proof-of-concept that requires a user to be logge...
Cybozu Garoon 4.6.x <= 4.6.3 XSS Vulnerability
Cybozu Garron is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cybozu:garoon...
Cross site scripting
Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Portal'...
CVE-2019-5929: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the application 'Memo'...
CVE-2019-5940: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Scheduler'...
CVE-2019-5939: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Portal'...
CVE-2019-5932: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Portal'...
CVE-2019-5947: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Cabinet'...