Design/Logic Flaw

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT...

CVE-2019-19327

The CVE-2019-19327 entry pertains to the Wikibase Wikidata Query Service GUI: the file ui/ResultView.js in versions prior to 0.3.6-SNAPSHOT (2019-11-07) is vulnerable to HTML injection when reporting the number of results and the number of milliseconds. The note indicates this GUI code is no long...

CVE-2019-19327

ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT...

CVE-2019-19328

CVE-2019-19328 affects the Wikibase Wikidata Query Service GUI, specifically the file ui/editor/tooltip/Rdf.js. The vulnerability exists in versions prior to 0.3.6-SNAPSHOT (2019-11-07) and permits HTML injection in entity tooltips, enabling an attacker to inject HTML content via tooltips. The no...

CVE-2019-19328

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors...

CVE-2015-4457

Multiple cross-site scripting XSS vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform...

CVE-2019-13714

Insufficient validation of untrusted input in Color Enhancer extension in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to inject CSS into an HTML page via a crafted URL...

CVE-2019-13714

Insufficient validation of untrusted input in Color Enhancer extension in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to inject CSS into an HTML page via a crafted URL...

Dell EMC RSA Authentication Manager CVE-2019-18574 HTML Injection Vulnerability

Description Dell EMC RSA Authentication Manager is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based...

Fortinet FortiGate CVE-2019-6697 HTML Injection Vulnerability

Description Fortinet FortiGate is prone to an HTML injection vulnerability because it fails to sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

Siemens Polarion Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Description Siemens Polarion is prone to multiple cross-site scripting vulnerabilities and an HTML-injection vulnerability. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

Stored xss vulnerability in Seven Bears repository system (CNVD-2019-46637)

Seven bears library system is a similar to Baidu library online document preview, selling system. A stored xss vulnerability exists in the Seven Bears library system, which can be exploited by an attacker to inject arbitrary Web script or HTML...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in POSH aka Posh portal or Portaneo 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 error parameter to /includes/plugins/mobile/scripts/login.php or 2 id parameter to portal/openrssarticle.php...

CVE-2013-0202

The CVE-2013-0202 entry applies to ownCloud with XSS in core/ajax/sharing.php. Affected versions include ownCloud Server < 4.0.11 and

CVE-2015-2793

Cross-site scripting XSS vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openididentifier parameter in a verify action to ikiwiki.cgi...

Zomato: HTML injection leads to reflected XSS

The following payload was used to bypass the WAF: html "...

CVE-2011-4454

The CVE-2011-4454 entry corresponds to multiple XSS vulnerabilities in Tiki Wiki CMS Groupware, affected through path-info in 8.0 RC1 and earlier (tiki-remind_password.php, tiki-index.php, tiki-login_scr.php, tiki-index). The root cause is improper handling of path input leading to injection of a...

CVE-2013-0193

Cross-site Scripting XSS in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195...