CVE-2017-6906

SiberianCMS before 4.10.0 is vulnerable due to insufficient filtration of user-supplied data (log) passed to SiberianCMS-master/errors/500.php, allowing an attacker to execute arbitrary HTML/JavaScript in the context of the vulnerable website. This risk is documented with CVSS metrics (MEDIUM). N...

IBM Rational Rhapsody Design Manager HTML Injection Vulnerability

IBM Rational Rhapsody Design Manager is a set of collaborative design management software from IBM in the United States. IBM Rational Rhapsody Design Manager suffers from an HTML injection vulnerability. The vulnerability allows remote attackers to inject malicious script or HTML code, which can ...

Zammad Cross-Site Scripting Vulnerability

Zammad is a web-based, open-source helpdesk/customer support system from the German company Zammad, with many features to manage customer communication through multiple channels such as phone calls. A cross-site scripting vulnerability exists in Zammad. An attacker can exploit this vulnerability ...

HTML Injection

Overview Affected versions of shout do not escape the /topic command in messages, and are therefore vulnerable to cross-site scripting. Recommendation Update to version 0.50.0 or later. References - PR 344 - GitHub Advisory...

CVE-2017-6555

Cross-site scripting XSS vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1description parameter aka "Design Manager Categories Category Description"...

CVE-2017-6555

CMS Made Simple 2.1.6 is affected by a Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php, exploitable via the m1_description parameter under Design Manager > Categories > Category Description. The CVE-2017-6555 entry notes that remote authenticated users can inject arbi...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 Template Name field when renaming a template; 2 KDC Server host, 3 Kerberos Security Realm, 4 Kerberos Encryption Types, 5 Advanced...

CVE-2016-4948

Multiple cross-site scripting XSS vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 Template Name field when renaming a template; 2 KDC Server host, 3 Kerberos Security Realm, 4 Kerberos Encryption Types, 5 Advanced...

CVE-2016-7138

Cross-site scripting XSS vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2016-7139

CVE-2016-7139 is a cross-site scripting (XSS) vulnerability in Plone CMS, affecting Plone 5.x up to 5.0.6, 4.x up to 4.3.11, and 3.3.x up to 3.3.6. The flaw is described as an XSS in an unspecified page template, allowing remote attackers to inject arbitrary web script or HTML via unknown vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in CA Service Desk Manager formerly CA Service Desk 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REFNUM parameter...

CVE-2016-9148

Cross-site scripting XSS vulnerability in CA Service Desk Manager formerly CA Service Desk 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REFNUM parameter...

Cross site scripting

Multiple Cross-Site Scripting XSS issues were discovered in INTER-Mediator 5.5. The vulnerabilities exist due to insufficient filtration of user-supplied data c and cred passed to the "INTER-Mediator-master/AuthSupport/PasswordReset/resetpassword.php" URL. An attacker could execute arbitrary HTML...

Cross site scripting

Multiple Cross-Site Scripting XSS issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data state, element, id, tab, cid passed to the "EPESI-master/modules/Utils/RecordBrowser/favorites.php" URL. An attacker could execute arbitrary HT...

CVE-2017-5616

Cross-site scripting XSS vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the addendum parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

Cross site scripting

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creating a new monitor...

CVE-2016-10201

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php...