Magento HTML Injection Vulnerability

Magento is a professional open source PHP e-commerce system from Magento, USA, which provides permission management, search engine and payment gateway. Magento has an HTML injection vulnerability. A remote attacker can exploit the vulnerability to execute arbitrary script or HTML code in the...

Adobe ColdFusion Multiple Vulnerabilities (APSB15-29) (credentialed check)

The version of Adobe ColdFusion running on the remote Windows host is affected by multiple vulnerabilities : - Multiple cross-site scripting XSS vulnerabilities exist due to a failure to validate input before returning it to the user. A remote attacker can exploit these to inject arbitrary script...

Google AOSP Email App HTML Injection

https://labs.integrity.pt/articles/google-aosp-email-app-html-injection-2/ 1. Vulnerability Properties Title: Google AOSP Email App HTML Injection CVE ID: PendingCVSSv3 Base Score: 6.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Vendor: Google Products: AOSP Email App Advisory Release Date: 16 November...

CVE-2015-8233

Cross-site scripting XSS vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote administrators with the "Administer themes" permission to inject arbitrary web script or HTML via unspecified vectors related to theme settings...

CVE-2015-8105

Cross-site scripting XSS vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload...

CVE-2015-8105

CVE-2015-8105 affects Roundcube webmail, specifically the vulnerable component is program/js/app.js. The XSS flaw arises in the drag-and-drop file upload via the filename field, impacting Roundcube versions before 1.0.7 and 1.1.x before 1.1.3. Exploitation requires remote authenticated access, en...

Cisco FireSIGHT Management Center Cross-Site Scripting / HTML Injection Vulnerability

A vulnerability in the web interface of Cisco FireSIGHT Management Center MC could allow an authenticated, remote attacker to modify a page of the web interface. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by t...

CVE-2015-5733

Cross-site scripting XSS vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title...

Komento Component HTML Injection Vulnerability in Joomla!

Joomla! is an open source content management system CMS developed by the Open Source Matters team in the U.S. Komento is one of the generic commenting components. An HTML injection vulnerability exists in Joomla! Komento component versions prior to 2.0.5. An attacker can exploit this vulnerabilit...

CVE-2015-6353

Multiple cross-site scripting XSS vulnerabilities in Cisco FireSight Management Center MC 5.3.1.5 and 5.4.x through 5.4.1.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuu28922...

CVE-2015-6349

Cross-site scripting XSS vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server ACS 5.70.15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2006-3174

Cross-site scripting XSS vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter...

phpmyadmin: content spoofing

This vulnerability allows an attacker to perform a content spoofing attack using the phpMyAdmin's redirection mechanism to external sites. This vulnerability is not considered to be critical since the spoofed content is escaped and no HTML injection is possible...

Cisco FireSIGHT Management Center HTML Injection Vulnerability

A vulnerability in the web interface of Cisco FireSIGHT Management Center MC could allow an authenticated, remote attacker to modify a page of the web interface. The vulnerability is due to improper sanitization of parameter values. An attacker could exploit this vulnerability by injecting...

CVE-2015-3970

Multiple cross-site scripting XSS vulnerabilities in the web interface on Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web interface on Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-3970

Multiple cross-site scripting XSS vulnerabilities in the web interface on Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6844

Cross-site scripting XSS vulnerability in Reviewer in EMC SourceOne Email Supervisor before 7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5444

CVE-2015-5444 affects HP Smart Profile Server Data Analytics Layer (SPS DAL) 2.3 up to 2.3.4; multiple XSS vulnerabilities allow remote attackers to inject arbitrary web script via unspecified vectors. Root cause details aren’t explicitly stated in the connected documents. Impact is remote code e...

CVE-2015-1812

Cross-site scripting XSS vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813...