Microsoft Exchange Server CVE-2015-2359 HTML Injection Vulnerability

Description Microsoft Exchange Server is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

Multiple vulnerabilities in vfront

vfront is a set of open source based on PHP and JavaScript MySQL or PostgreSQL database front-end management tools . There are multiple security vulnerabilities in vfront , allowing attackers to exploit vulnerabilities in cross-site scripting , cross-site request forgery , and HTML injection...

Unspecified Cross-Site Scripting Vulnerability in IBM Marketing Operations

IBM Marketing Operations formerly known as IBM Unica Marketing Operations is a suite of marketing management software from the American company IBM. The software supports streamlining of production processes, tracking of budgets and expenditures, and improved teamwork. An unspecified cross-site...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Marketing Operations 7.x and 8.x before 8.5.0.7.2, 8.6.x before 8.6.0.8, 9.0.x before 9.0.0.4.1, 9.1.0.x before 9.1.0.5, and 9.1.1.x before 9.1.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Moodle 'lib/externallib.php' Cross-Site Scripting Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in the 'externalformattext' function in the Moodle 'lib/externallib.php' script. A remote...

WordPress plugin wp-smiley HTML injection vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL. wp-smiley is one of the plugins used to customize the emoticon icon. An HTML injection vulnerability exists in the...

WordPress NextScripts: Social Networks Auto-Poster HTML Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on PHP and MySQL servers.NextScripts: Social Networks Auto-Poster is one of the plug-ins that automatically forwards blog posts to Facebook and oth...

Multiple Vulnerabilities in WordPress Anti-Malware and Brute-Force Security by ELI Plugin

WordPress is a blogging platform developed in PHP by the WordPress Software Foundation, which supports personal blog sites on PHP and MySQL servers.Anti-Malware and Brute-Force Security by ELI is one of the quick detection of malicious code and removal of threats by the Plugin. The WordPress...

Cisco FireSIGHT Management Center XSS and HTML Injection Vulnerabilities

Multiple vulnerabilities in the administrative web interface of the Cisco FireSIGHT Management Center could allow an attacker to conduct both cross-site scripting XSS and also arbitrary HTML command injection attacks. These vulnerabilities are due to improper user input validation. An attacker...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to 1 org/apache/sling/api/servlets/HtmlResponse and 2...

CVE-2015-0212

Cross-site scripting XSS vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted course summary...

CVE-2015-2269

CVE-2015-2269 refers to multiple XSS vulnerabilities in Moodle’s lib/javascript-static.js, exploitable by remote authenticated users via the alt or title attributes of IMG elements. Affected Moodle versions are up to 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4. The provi...

Mail.ru: HTML Injection на e.mail.ru

Здравствуйте, Я обнаружил HTML инъекцию на e.mail.ru с помощью текстовых файлов формата .txt Proof of concept: Создаем HTML файл с правильными тегами, то есть html head body... должны присутствовать. Иначе файл не будет воспроизведен как HTML Меняем конец файла на .txt Далее сжимаем этот файл при...

Dolibarr 3.5 / 3.6 HTML Injection

Title: HTML Injection in dolibarr Author: Sergio Galán - @NaxoneZ Date: May 20,2015 Vendor Homepage: http://www.dolibarr.es/ Vulnerable version: 3.5 / 3.6 CVE: CVE-2015-3935 Dolibarr no properly escape untrusted data to prevent injection Page affected - dolibarr-3.7.0/htdocs/societe/societe.php -...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in roomcloud.php in the Roomcloud plugin before 1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 pin, 2 startday, 3 startmonth, 4 startyear, 5 endday, 6 endmonth, 7 endyear, 8 lang, 9 adults, or 10 children...

CVE-2015-3904

Multiple cross-site scripting XSS vulnerabilities in roomcloud.php in the Roomcloud plugin before 1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 pin, 2 startday, 3 startmonth, 4 startyear, 5 endday, 6 endmonth, 7 endyear, 8 lang, 9 adults, or 10 children...

CVE-2015-4063

Cross-site scripting XSS vulnerability in includes/nspsearch.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nspsearch page to wp-admin/admin.php...

Feed to JavaScript 'magpie_debug.php' HTML Injection Vulnerability

Feed to JavaScript is a set of tools to output feed content in JS and embed it into a web page to make a list of articles. An HTML injection vulnerability exists in Feed to JavaScript, which can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix10, 6.0.5 before 6.0.5.6, and 6.0.5.5a before 6.0.5.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...