16172 matches found
Cross site scripting
HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...
CVE-2018-19905
HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...
CVE-2018-19905
HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...
CVE-2018-19905
razorCMS 3.4.8 is affected by an HTML injection via the /#/page keywords parameter. The issue concerns the keywords field in that endpoint, enabling arbitrary HTML injection. Remediation hints from PT-2018-15155 suggest restricting access to the /#/page API or stopping use of the keywords paramet...
PT-2018-15155 · Razorcms · Razorcms
Name of the Vulnerable Software and Affected Versions: razorCMS version 3.4.8 Description: The issue is related to HTML injection in the software. It can be exploited via the "//page" API endpoint, specifically through the keywords parameter. Recommendations: For razorCMS version 3.4.8, consider...
Debian DSA-4358-1 : ruby-sanitize - security update
The Shopify Application Security Team discovered that ruby-sanitize, a whitelist-based HTML sanitizer, is prone to a HTML injection vulnerability. A specially crafted HTML fragment can cause to allow nonwhitelisted attributes to be used on a whitelisted HTML element. C Tenable Network Security,...
[SECURITY] [DSA 4358-1] ruby-sanitize security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4358-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 27, 2018 https://www.debian.org/security/faq -...
Debian: Security Advisory (DSA-4358-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Steve Pallen Xain Cross-Site Scripting Vulnerability
Steve Pallen Xain is a library that provides HTML markup for Elixir. A cross-site scripting vulnerability exists in versions of Steve Pallen Xain prior to 0.6.2, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'order' parameter...
Design/Logic Flaw
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...
CVE-2018-19596
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...
CVE-2018-19596
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...
CVE-2018-19596
Zurmo 3.2.4 is vulnerable to HTML Injection (XSS) in the reports section via an admin using HTML in the report details (app/index.php/reports/default/details?id=1). ThisCVEdescription maps to CVE-2018-19596 and is related to CVE-2018-19506. The connected documents confirm the affected component a...
CVE-2018-19596
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...
Nagios Core <= 4.4.2 XSS Vulnerability
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified checkload plugin to NRPE. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by th...
Micro Focus NetIQ iManager Cross-Site Scripting Vulnerability
Micro Focus NetIQ iManager is a WEB-based application from Micro Focus UK. The program can manage, configure eDirectory objects using wireless devices. A cross-site scripting vulnerability exists in Micro Focus NetIQ iManager versions prior to 3.1 SP2, which can be exploited by remote attackers t...
IBM Curam Social Program Management HTML Injection Vulnerability
IBM Cúram Social Program Management SPM is a suite of social program management solutions from IBM in the United States. The solution supports the end-to-end social program delivery process.Social Program Management Design System is one of the Social Program Management Design System components. A...
CVE-2018-16636
Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter...