[ASA-201610-4] kcoreaddons: insufficient validation

Arch Linux Security Advisory ASA-201610-4 ========================================= Severity: Medium Date : 2016-10-07 CVE-ID : CVE-2016-7966 Package : kcoreaddons Type : insufficient validation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package kcoreaddons...

CVE-2016-6425

Cross-site scripting XSS vulnerability in Cisco Unified Intelligence Center CUIC 8.5.4 through 9.11, as used in Unified Contact Center Express 10.01 through 11.01, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCuy75020 and CSCuy81652...

CVE-2016-5892

Cross-site scripting XSS vulnerability in IBM 10x, as used in Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications before 1.0.0.52, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

UBUNTU-CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

Nextcloud: Bad content-type in response header when getting document can lead to html injection

Bug When request document by genesisid or filename, the content-type field in response header is 'text/html'. And the document content can be anything. So if we upload an odt file with html format and share with other users, it can lead to html injection when others request that file. PoC - img1...

Red Hat JBoss BPMS HTML Injection Vulnerability

Red Hat JBoss BPM Suite is a business process management platform from Red Hat, Inc. that brings together all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation and business process monitoring. An HTML injection vulnerability exists in Redhat...

Twonky Server < 4.4.18, 5.0.x < 5.0.66 Multiple Vulnerabilities

Twonky Server is prone to a cross-site scripting XSS vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be...

Cross site scripting

Cross-site scripting XSS vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to inject arbitrary web script or HTML via the back parameter to ossim/conf/reload.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies...

CVE-2016-5944

Cross-site scripting XSS vulnerability in the Web UI in IBM Spectrum Control formerly Tivoli Storage Productivity Center 5.2.x before 5.2.11 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web UI in IBM Spectrum Control formerly Tivoli Storage Productivity Center 5.2.x before 5.2.11 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string...

Multiple Vulnerabilities in BINOM3 Electric Power Quality Meter

BINOM3 Electric Power Quality Meter is an electrical power quality monitor for SCADA systems from the Russian company BINOM3. Cross-site scripting vulnerabilities, HTML injection vulnerabilities, security bypass vulnerabilities, and information disclosure vulnerabilities exist in BINOM3 Electric...

WordPress Plugin Woocommerce API Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Woocommerce, which can be exploited by...

b2evolution HTML Injection Vulnerability

b2evolution is a PHP and MySQL based blogging software developed by software developer Francois Planque. An HTML injection vulnerability exists in b2evolution 6.7.5 and earlier versions, which stems from the program's failure to adequately filter user-submitted input. When a user browses the...

b2evolution HTML injection vulnerability (CNVD-2016-07942)

b2evolution is a PHP and MySQL based blogging software developed by software developer Francois Planque. An HTML injection vulnerability exists in b2evolution 6.7.5 and earlier versions, which stems from the program's failure to adequately filter user-submitted input. When a user browses the...

OpenStack manila HTML Injection Vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration NASA and Rackspace, Inc. in the United States. An HTML injection vulnerability exists in OpenStack manila. As the program fails to adequately filter user-submitted input. When a user...

Cross site scripting

Cross-site scripting XSS vulnerability in the web framework in Cisco IOx Local Manager in IOS 15.52T and IOS XE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy19854...

PT-2016-23: Cross-Site Scripting in SAP NetWeaver

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in SAP NetWeaver. Reflected cross-site scripting in the "/com.sapportals.navigation.testComponent.NavigationRequestSniffer" component allows remote attackers to inject arbitrary HTML tags including...

PT-2016-21: Cross-Site Scripting in SAP NetWeaver

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in SAP NetWeaver. Reflected cross-site scripting in the "/com.sap.portal.themes.integrity.personalization", "/com.sap.portal.themes.integrity.url",...