youngisrael-stl.org XSS vulnerability

Open Bug Bounty ID: OBB-578100 Description| Value ---|--- Affected Website:| youngisrael-stl.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-0547

Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0547: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0546: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

mailman -- hardening against malicious listowners injecting evil HTML scripts

Mark Sapiro reports: Existing protections against malicious listowners injecting evil scripts into listinfo pages have had a few more checks added. A few more error messages have had their values HTML escaped. The hash generated when SUBSCRIBEFORMSECRET is set could have been the same as one...

Z-BlogPHP Cross-Site Scripting Vulnerability

Z-BlogPHP is an open source PHP-based blogging system developed by the Z-Blog community. A cross-site scripting vulnerability exists in Z-BlogPHP version 1.5.1.1740. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML...

CVE-2018-6811: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Citrix NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to inject arbitrary web script or HTML via the Citrix NetScaler interface...

everytalk.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-574295 Description| Value ---|--- Affected Website:| everytalk.co.kr Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

cybertelbridge.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-574259 Description| Value ---|--- Affected Website:| cybertelbridge.co.kr Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

Open-Xchange: [XSS/CSRF] filter content-type bypass in Files v2.0

Hi. sandbox.open-xchange.com runs a version that contains a fix for your first report First report 304098 If you found a valid workaround, please open a new report, thanks : : Yeah, I tested now in sandbox. Steps: 1. Add Note with any html tags 2. Change Fileinfo: json...

Slack: HTML Injection inside Slack promotional emails

Hi, There's a HTML injection vulnerability present inside emails sent from slack when the FIRST name on the account contains HTML. The html is stored in the backend database and when emails are sent promotional, etc, the HTML is sent along with the rest of the email. In my PoC, which is provided...

CVE-2017-6927: Improper Neutralization of Input During Web Page Generation

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain JavaScript function which is used to escape potentially dangerous text before outputting it to HTML as JavaScript output does not typically go through Twig autoescaping. This function does not correctly...

Drupal 7.x < 7.57 Multiple Vulnerabilities (SA-CORE-2018-001)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.57. It is, therefore, affected by multiple vulnerabilities : - A flaw exists with the Drupal.checkPlain function due to improper handling of HTML injection. A remote attacker, with a...

Drupal 8.x < 8.4.5 Multiple Vulnerabilities (SA-CORE-2018-001)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.4.5. It is, therefore, affected by multiple vulnerabilities : - A flaw exists with the Comment Reply Form. An authenticated remote attacker could add or view comments that they do not...

Node.js third-party modules: [m-server] HTML Injection in filenames displayed as directory listing in the browser allows to embed iframe with malicious JavaScript code

I would like to report Stored XSS vulnerability in m-server module. m-server displays content of selected directory as HTML in the browser. However, no escape is implemented which allows malicious user to embed executable JavaScript or HTML code eg. to load HTML document into iframe element and...

Magento CMS Admin Panel HTML Injection Vulnerability

Magento CMS is the United States Magento company's set of open source PHP e-commerce content management system CMS. An HTML injection vulnerability exists in Magento CMS. An attacker can exploit the vulnerability to execute arbitrary script code on the browsers of affected website users, steal...

MediaWiki SyntaxHighlight Extended HTML Injection Vulnerability

MediaWiki is a free, web-based wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers for the deployment of in-house knowledge management and content management systems. An HTML injection vulnerability exists in the MediaWiki SyntaxHighlight extension, which ste...

CVE-2018-0519

Cross-site scripting vulnerability in FS010W firmware FS010W00V1.3.0 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0519

Cross-site scripting vulnerability in FS010W firmware FS010W00V1.3.0 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

Tiki Wiki CMS Groupware Multiple Vulnerabilities (Feb 2018)

Tiki Wiki CMS Groupware is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...