CVE-2017-1115

IBM Campaign (Unica Campaign) versions 9.1, 9.1.2, and 10 are affected by an HTML injection vulnerability. A remote attacker could inject malicious HTML that would be executed in a victim’s browser within the hosting site’s security context. The issue is documented across multiple feeds (IBM X-Fo...

CVE-2017-1115

IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 121153...

Design/Logic Flaw

IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 121153...

CVE-2017-1115

IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 121153...

CVE-2017-1115

IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 121153...

CVE-2018-0654

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modal for creating Wiki page...

CVE-2018-0642

Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0652

GROWI is affected: CVE-2018-0652 is a Stored XSS in the UserGroup Management section of admin page, impacting GROWI v3.1.11 and earlier. The underlying issue allows remote attackers with authentication to inject arbitrary scripts/HTML in the logged-in user’s browser. Documented impact includes ar...

CVE-2017-1115: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 121153...

CVE-2018-0642: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0652: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page...

CVE-2018-0657: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module PG Multi-Payment Service for EC-CUBE EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version...

CVE-2018-0653: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki page view...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 discription or 2 comments field, related to users/userAddContent...

CVE-2018-16622

Multiple cross-site scripting XSS vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 discription or 2 comments field, related to users/userAddContent...

CVE-2018-15917

CVE-2018-15917 affects Jorani Leave Management System v0.6.5. The issue is a persistent XSS in the language parameter (session/language) that stores user input in the session, enabling an attacker to inject arbitrary script executed by other users (including admins). Evidence across sources confi...

Cross site scripting

Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0672

Movable Type suffers a Cross‑Site Scripting (CWE-79) vulnerability in versions prior to 6.3.1. The NVD/NVD-derived records indicate that remote attackers could inject arbitrary scripts via unspecified vectors, potentially executing in a user’s browser. Affected software: Movable Type (Six Apart) ...

CVE-2018-0672: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Grammarly: Emails from Grammarly missing sanitization(lack of validation?) -> HTML injection in emails

Summary: Emails from Grammarly e.g. "reset password" email missing HTML sanitization. That leads to content spoofing in emails. Steps To Reproduce: 1. Go to "Profile" 2. Find reset password tab if you're logged in using FB/Google, you won't see this menu 3. Change email to something like:...