CVE-2017-14981

ATutor before 2.2.3 contains a cross-site scripting (XSS) vulnerability due to insufficient filtering of data in the URL parameter used by /mods/_standard/rss_feeds/edit_feed.php. An attacker could inject arbitrary HTML/JavaScript that runs in the context of the affected site. The available docum...

The vulnerability of the “/com.sap.portal.themes.styleservice.LockingTestPortalComponent” component of the SAP NetWeaver software integration platform allows a hacker to inject any HTML tags into a page.

The vulnerability of the “/com.sap.portal.themes.styleservice.LockingTestPortalComponent” component of the SAP NetWeaver software integration platform exists due to the lack of measures taken to protect the structure of web pages. This vulnerability allows a malicious actor to inject arbitrary HT...

The vulnerabilities of the components “/com.sap.portal.themes.integrity.personalization”, “/com.sap.portal.themes.integrity.url”, and “/com.sap.portal.themes.integrity.serverFrameworkCockpit” of the SAP NetWeaver software integration platform allow a malicious individual to inject arbitrary HTML tags into a page.

The vulnerability of the components “/com.sap.portal.themes.integrity.personalization”, “/com.sap.portal.themes.integrity.url”, and “/com.sap.portal.themes.integrity.serverFrameworkCockpit” of the SAP NetWeaver software integration platform exists due to the lack of measures taken to protect the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...

Ipython Cross-Site Scripting Vulnerability (CNVD-2017-35321)

IPython is an enhanced version of Python's native interactive shell developed by the IPython team. A cross-site scripting vulnerability exists in versions of Ipython prior to 3.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross site scripting

Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...

WordPress Template Name Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress template names. A remote attacker can exploit this vulnerability to...

WordPress Plugin Editor Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin editor. A remote attacker can exploit this vulnerability ...

CVE-2017-14619

Cross-site scripting XSS vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module...

CVE-2017-14618

CVE-2017-14618 is a documented XSS vulnerability in phpMyFAQ up to version 2.9.8. The flaw resides in inc/PMF/Faq.php, allowing an attacker to inject arbitrary web script or HTML via the Questions field in an Add New FAQ action. Public references (Exploit-DB and packetstorm) confirm a stored XSS ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors related to name and message...

VMware vCenter Server HTML Injection Vulnerability

VMware vCenter Server enables rapid deployment of virtual machines and monitors the performance of physical servers and virtual machines. An HTML injection vulnerability exists in VMware vCenter Server, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML...

Mail.ru: Stored XSS and html injection in biz.mail.ru

Domain, site, application: biz.mail.ru Testing environment: Latest chrome Steps to reproduce 1 go to biz.mail.ru, login 2 go to "My company" 3 create a department named as "alert 4 add an employee in that department 5 create a new subdepartment 6 add the employee from step 4 in our subdepartment...

Advanced Man In The Middle Framework: Xerosploit

Xerosploit is a penetration testing toolkit whose goal is to perform man in the middle attacks for penetration testing purposes. It brings various modules together that will help you perform very efficient attacks. You can also use it to perform denial of service attacks and port scanning. Powere...

anchor-cms cross-site scripting vulnerability

anchor-cms is an open source light blogging system. The system supports Markdown editor , custom fields and multiple languages and so on. A cross-site scripting vulnerability exists in versions prior to anchor-cms 0.9-dev. A remote attacker can exploit this vulnerability to inject arbitrary web...

CVE-2017-13754

CVE-2017-13754 is an XSS flaw in Wibu-Systems CodeMeter (advanced settings – time server) where an attacker can inject script via the server name field in actions/ChangeConfiguration.html. Vulnerable until CodeMeter version 6.50b (and is embedded in some FactoryTalk Activation Manager releases pr...

CVE-2017-13754

Cross-site scripting XSS vulnerability in the "advanced settings - time server" module in Wibu-Systems CodeMeter before 6.50b allows remote attackers to inject arbitrary web script or HTML via the "server name" field in actions/ChangeConfiguration.html...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in phpThumb before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php...

Red Hat Satellite Cross-Site Scripting Vulnerability

Red Hat Satellite is a suite of system management platforms from Red Hat, Inc. that can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. A cross-site scripting vulnerability exists in Red Hat Satellite version...

CVE-2015-6942

CVE-2015-6942 is an XSS vulnerability in Coremail XT3.0, where a hyperlink embedded in a document attachment can execute arbitrary script when the recipient previews the attachment. Public details indicate a stored XSS scenario via a hyperlink in the attachment, aligning with the Coremail XT3.0 c...