620 matches found
CVE-2018-13375
CVE-2018-13375 is an XSS-style vulnerability in Fortinet products where FortiAnalyzer 5.6.0 and earlier and FortiManager 5.6.0 and earlier fail to properly neutralize script-related HTML tags in the DHCP HOSTNAME parameter. An attacker can inject malicious scripts via a DHCP request, and the scri...
CVE-2018-5124
Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1...
CVE-2018-5124
Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1...
Cross-Site Scripting in react-dom
Affected versions of react-dom are vulnerable to Cross-Site Scripting XSS. The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by...
CVE-2018-16096
In System Management Module SMM versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting...
PT-2018-2172
Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 affected versions not specified Description The issue is related to an improper neutralization of script-related HTML tags in a web page, which can be exploited to execute a password change on...
Cross-Site Scripting
Overview Versions of exceljs before 1.6.0 are vulnerable to cross-site scripting. This vulnerability is due to exceljs does not validate data from parsed XLSX file and allows to embed HTML tags, like , directly in the sheet cells. Because of this it's possible to inject malicious JavaScript code...
Shopify: Stored xss
Description : WAF cut html tages but when put before tages we can bypass it : . Step to reproduce : 1-Open your store account 2-Navigate to https://xxx.myshopify.com/admin/settings/general 3-Put your street address xss payload xss" 4-Go to https://xxx.myshopify.com/admin/dashboards/live 5-XSS ale...
DEBIAN-CVE-2017-15705
A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and...
CVE-2016-8613
A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. T...
CVE-2016-8613
A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. T...
Cross site scripting
A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. T...
CVE-2016-8613: Improper Neutralization of Input During Web Page Generation
A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. T...
FreeBSD : wordpress -- multiple issues (4740174c-82bb-11e8-a29a-00e04c1ea73d)
wordpressdevelopers reports : Taxonomy: Improve cache handling for term queries. Posts, Post Types: Clear post password cookie when logging out. Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen. Community Events Dashboard: Always show the nearest WordCamp if one is...
wordpress -- multiple issues
wordpressdevelopers reports: Taxonomy: Improve cache handling for term queries. Posts, Post Types: Clear post password cookie when logging out. Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen. Community Events Dashboard: Always show the nearest WordCamp if one is...
CVE-2017-16043: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Shout is an IRC client. Because the /topic command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout =0.44.0 =0.49.3...
Office 365 in the 0-day vulnerability baseStriker appear in the wild examples of the use-vulnerability warning-the black bar safety net
5 October 1, Avanan the researchers found that Office 365 appears in a named baseStriker of 0-day vulnerabilities. An attacker can exploit this vulnerability to send malicious mail, bypassing the Office 365 account security mechanisms. ! baseStriker vulnerability of the code to use the less...
CVE-2018-1000154
Zammad (version 2.3.0 and earlier) contains an Improper Neutralization of Script-Related HTML Tags in email subjects (CWE-80) that can lead to embedding/execution of JavaScript in a user’s browser, exploitable when a ticket is opened. Affected: Zammad
