FortiMail - HTML injection in Calendar

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiMail may allow an authenticated attacker to inject HTML tags in FortiMail's calendar via input fields...

CVE-2023-36637: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to inject HTML tags in FortiMail's calendar via input fields...

PT-2023-6015

Name of the Vulnerable Software and Affected Versions FortiMail versions 7.0.0 through 7.0.4 FortiMail versions 7.2.0 through 7.2.2 Description The issue is related to the improper neutralization of input during web page generation, which can be exploited by a remote attacker to execute arbitrary...

CVE-2023-44393

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting XSS vulnerability is in the /admin.php?page=plugins&tab=new&installstatus=ok&pluginid=here page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS co...

CVE-2023-44393 Piwigo Reflected XSS vulnerability

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting XSS vulnerability is in the /admin.php?page=plugins&tab=new&installstatus=ok&pluginid=here page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS co...

Arbitrary File Overwrite

ansible is vulnerable to Arbitrary File Overwrite. This vulnerability allows remote attackers to inject arbitrary HTML and script code into the response. This could allow attackers to steal cookies, perform phishing attacks, or take control of vulnerable systems...

EventPrime < 3.2.0 - Reflected HTML Injection on keyword parameter

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website. PoC Insert '"Clickme! on the keyword search field or directly on the link...

EventPrime < 3.2.0 - Reflected HTML Injection on keyword parameter

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website. Insert '"Clickme! on the keyword search field or directly on the link...

Cisco Catalyst SD-WAN Manager HTML Injection Vulnerability

Cisco Catalyst is a series of switches from the American company Cisco. An HTML injection vulnerability exists in Cisco Catalyst SD-WAN Manager that stems from improper validation of user-supplied data in element fields and can be exploited by an authenticated, remote attacker to inject HTML...

CVE-2023-43071

Dell SmartFabric Storage Software v1.4 and earlier contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attacker could potentially exploit these issues, leading to variou...

CVE-2023-43071

Dell SmartFabric Storage Software v1.4 and earlier contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attacker could potentially exploit these issues, leading to variou...

Cross site scripting

Dell SmartFabric Storage Software v1.4 and earlier contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attacker could potentially exploit these issues, leading to variou...

CVE-2023-43071

Dell SmartFabric Storage Software v1.4 and earlier contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attacker could potentially exploit these issues, leading to variou...

CVE-2023-43071

Dell SmartFabric Storage Software v1.4 and earlier contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attacker could potentially exploit these issues, leading to variou...

CVE-2023-43071

CVE-2023-43071 affects Dell SmartFabric Storage Software v1.4 and earlier, with HTML injection and potential CVS/formula injection in the GUI due to insufficient input filtering/escaping. An attacker with remote authenticated access could exploit these issues to cause cross-site scripting on HTML...

USN-6419-1: jQuery UI vulnerabilities

Hong Phat Ly discovered that jQuery UI did not properly manage parameters from untrusted sources, which could lead to arbitrary web script or HTML code injection. A remote attacker could possibly use this issue to perform a cross-site scripting XSS attack. This issue only affected Ubuntu 14.04 LT...

CVE-2023-43071: Improper Neutralization of Formula Elements in a CSV File

Dell SmartFabric Storage Software v1.4 and earlier contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attacker could potentially exploit these issues, leading to variou...

CVE-2023-44390: Improper Neutralization of Input During Web Page Generation

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. In the case an application sanitizes us...

PT-2023-28681 · Dell · Dell Smartfabric Storage

Name of the Vulnerable Software and Affected Versions: Dell SmartFabric Storage Software versions 1.4 and earlier Description: The issue concerns possible vulnerabilities for HTML injection or CVS formula injection, which might escalate to cross-site scripting attacks in HTML pages in the GUI. A...

CVE-2023-3971

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise...