16138 matches found
CVE-2018-19992
A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to adherents/type.php...
Cross site scripting
A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to user/card.php...
CVE-2018-19414
Multiple cross-site scripting XSS vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 keyword parameter to groups.php; 2 username parameter to login.php; or 3 date parameter to search.php...
Fedora 28 : qutebrowser (2018-5c8854a808)
This update fixes an XSS vulnerability on the qute://history page :history. The vulnerability allowed websites to inject HTML into the page via a crafted title tag. This could allow them to steal your browsing history. It also ships some minor fixes not worth mentioning. ---- Add a few minor...
razorCMS HTML Injection Vulnerability (CNVD-2019-00806)
razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. An injection vulnerability exists in razorCMS version 3.4.8. An attacker can use the 'keywords' parameter of the //page page to inject arbitrary HTM...
CVE-2018-19905
HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...
Cross site scripting
HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...
CVE-2018-19905
HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...
CVE-2018-19905
razorCMS 3.4.8 is affected by an HTML injection via the /#/page keywords parameter. The issue concerns the keywords field in that endpoint, enabling arbitrary HTML injection. Remediation hints from PT-2018-15155 suggest restricting access to the /#/page API or stopping use of the keywords paramet...
CVE-2018-19905
HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...
PT-2018-15155 · Razorcms · Razorcms
Name of the Vulnerable Software and Affected Versions: razorCMS version 3.4.8 Description: The issue is related to HTML injection in the software. It can be exploited via the "//page" API endpoint, specifically through the keywords parameter. Recommendations: For razorCMS version 3.4.8, consider...
Debian DSA-4358-1 : ruby-sanitize - security update
The Shopify Application Security Team discovered that ruby-sanitize, a whitelist-based HTML sanitizer, is prone to a HTML injection vulnerability. A specially crafted HTML fragment can cause to allow nonwhitelisted attributes to be used on a whitelisted HTML element. C Tenable Network Security,...
[SECURITY] [DSA 4358-1] ruby-sanitize security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4358-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 27, 2018 https://www.debian.org/security/faq -...
Debian: Security Advisory (DSA-4358-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Steve Pallen Xain Cross-Site Scripting Vulnerability
Steve Pallen Xain is a library that provides HTML markup for Elixir. A cross-site scripting vulnerability exists in versions of Steve Pallen Xain prior to 0.6.2, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'order' parameter...
Design/Logic Flaw
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...
CVE-2018-19596
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...
CVE-2018-19596
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...
CVE-2018-19596
Zurmo 3.2.4 is vulnerable to HTML Injection (XSS) in the reports section via an admin using HTML in the report details (app/index.php/reports/default/details?id=1). ThisCVEdescription maps to CVE-2018-19596 and is related to CVE-2018-19506. The connected documents confirm the affected component a...