CVE-2019-7334: Improper Neutralization of Input During Web Page Generation

Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in the view export export.php because proper filtration is omitted...

Cross site scripting

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8...

CVE-2019-7169

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/edit/3...

PT-2019-18451

Name of the Vulnerable Software and Affected Versions Croogo versions prior to 3.0.6 Description A stored-self XSS issue allows an attacker to execute HTML or JavaScript code in a vulnerable Title field to the "/admin/blocks/blocks/edit/8" API endpoint. Recommendations For versions prior to 3.0.6...

DEBIAN-CVE-2018-16477

A bypass vulnerability in Active Storage = 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the content-disposition and content-type parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as...

PT-2018-13599

Name of the Vulnerable Software and Affected Versions Active Storage versions 5.2.0 through 5.2.1.0 Description A bypass issue in Active Storage for Google Cloud Storage and Disk services allows an attacker to modify the content-disposition and content-type parameters, potentially executing HTML...

CVE-2018-19420

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension e.g., the test or test.asdf filename, because of admin/upload-uploadify.php, and validatesafefile in...

PT-2018-14954

Name of the Vulnerable Software and Affected Versions GetSimpleCMS version 3.3.15 Description The issue allows HTML execution through alternative file uploads. This can occur with files having no extension or unrecognized extensions, such as 'test' or 'test.asdf', due to vulnerabilities in...

CVE-2018-19420: Unrestricted Upload of File with Dangerous Type

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension e.g., the test or test.asdf filename, because of admin/upload-uploadify.php, and validatesafefile in...

Design/Logic Flaw

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension e.g.,...

CVE-2018-18964: Undefined Security Weakness

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several extensions in which contained HTML can be executed, such as the svg extension...

PT-2018-14747

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1 Description The issue is related to an incomplete '.htaccess' file for blacklist filtering in the product page. Specifically, the .htaccess file in catalog/images/ bans the html extension, but there are several...

CVE-2018-18965: Undefined Security Weakness

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension e.g.,...

PT-2018-14748

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1 Description The issue is related to an incomplete '.htaccess' file for blacklist filtering in the product page, allowing alternative cases for HTML execution. This includes files with no extension or unrecognized...

PoC Attack Leverages Microsoft Office and YouTube to Deliver Malware

A stealthy malware delivery tactic has been uncovered in the way videos are embedded into Microsoft Word Documents, according to researchers. It allows JavaScript code-execution when a user clicks on a weaponized YouTube video thumbnail within a Word document – with no alert message displayed by...

McAfee Threat Intelligence Exchange Server Code Injection Vulnerability

McAfee Threat Intelligence Exchange TIE Server is the United States McAfee McAfee company's set of threat detection and corresponding solutions. The program includes real-time protection, threat detection and endpoint protection. ePolicy Orchestrator ePO extension is one of the security managemen...

CVE-2018-10371: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser via a pag...

Cross site scripting

A stored cross-site scripting vulnerability in CA Identity Governance 12.6 allows remote authenticated attackers to display HTML or execute script in the context of another user...

Cross site scripting

RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Questionnaire ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application...

CVE-2017-14372: Improper Neutralization of Input During Web Page Generation

RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting vulnerabilities via certain RSA Archer Help pages. Attackers could potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application...