16138 matches found
CVE-2019-1565
The CVE-2019-1565 issue affects PAN-OS External Dynamic Lists. An authenticated user with write privileges can inject arbitrary JavaScript/HTML, impacting PAN-OS 7.1.x ≤7.1.21, 8.0.x ≤8.0.14, and 8.1.x ≤8.1.5. Remediation: upgrade to 7.1.22, 8.0.15, or 8.1.6 (or later). If not exploiting, no work...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the 1 c parameter or 2 a parameter...
Microsoft Windows .CONTACT File / HTML Injection Mailto: Remote Code Execution Vulnerability
Microsoft Windows is a popular operating system. A remote code execution vulnerability exists in Microsoft Windows .CCT File / HTML Injection Mailto:. The vulnerability is caused due to the processing of a ".contact" file, but the "email address" field uses the expected email address value. This...
UBUNTU-CVE-2019-6992
A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a long NAME or PROTOCOL to the index.php?view=controlcaps URI...
Microsoft Windows CONTACT - HTML Injection / Remote Code Execution Vulnerability
Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-HTML-INJECTION-MAILTO-LINK-ARBITRARY-CODE-EXECUTION.txt Vendor www.microsoft.com Produ...
Microsoft Windows CONTACT - HTML Injection Remote Code Execution
Microsoft Windows CONTACT - HTML Injection Remote Code Execution + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-HTML-INJECTION-MAILTO-LINK-ARBITRARY-CODE-EXECUTION.txt + ISR: ApparitionSec ...
Microsoft Windows CONTACT - HTML Injection / Remote Code Execution
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-HTML-INJECTION-MAILTO-LINK-ARBITRARY-CODE-EXECUTION.txt + ISR: ApparitionSec + Zero Day Initiative Program + ZDI-CAN-7591 Vendor...
Cross site scripting
A stored cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php...
CVE-2018-20729
A reflected cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php...
Webmin cross-site scripting vulnerability (CNVD-2019-01675)
Webmin is a web-based system administration tool for Unix-like operating systems developed by Australian software developer Jamie Cameron and the Webmin community. A cross-site scripting vulnerability exists in Webmin version 1.890, which can be exploited by remote attackers to inject arbitrary W...
Multiple Cross-site Scripting (XSS) Vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in actionpack/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the 1 format, 2 negativeformat, or 3 units...
Nextcloud: Stored XSS/HTML injection in autocomplete suggestions for sharing
encrypted report, see attached GnuPG file. I tried to send this by mail, but [email protected] told me that I'm forced sic! to signup here. Please use 7F40 5A4F FAA3 F51B FEFD EE2F CE82 B2C8 6DCE BB9F to contact me. Impact encrypted report, see attached GnuPG file...
The vulnerability of the onUploadLogPic component of the software controller allows for the insertion of arbitrary HTML code by intruders, enabling them to manipulate wireless networks through the D-Link Central WiFi Manager.
The vulnerability of the onUploadLogPic component of the software controller for D-Link Central WiFi Manager’s centralized wireless network management system is related to insufficient restrictions on file uploads. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML co...
CVE-2018-16164
Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...
Cross site scripting
Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Cross site scripting
Cross-site scripting vulnerability in LogonTracer 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2018-1000426
A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin
CVE-2018-16173
CVE-2018-16173 affects the WordPress LearnPress plugin prior to version 3.1.0. The vulnerability is a cross-site scripting (XSS) flaw that can let remote attackers inject arbitrary web script or HTML via unspecified vectors, potentially causing arbitrary script execution in the logged-in user’s b...
TWiki bin/statistics cross-site scripting vulnerability
TWiki is a WIKI encyclopedia program. A cross-site scripting vulnerability exists in TWiki bin/statistics. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...