Design/Logic Flaw

The sitepress-multilingual-cms WPML plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header...

FreeBSD : jenkins -- multiple vulnerabilities (9720bb39-f82a-402f-9fe4-e2c875bdda83)

Jenkins Security Advisory : DescriptionMedium SECURITY-1498 / CVE-2019-10401 Stored XSS vulnerability in expandable textbox form control Medium SECURITY-1525 / CVE-2019-10402 XSS vulnerability in combobox form control Medium SECURITY-1537 1 / CVE-2019-10403 Stored XSS vulnerability in SCM tag...

CVE-2015-9416

The sitepress-multilingual-cms WPML plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory: Description Medium SECURITY-1498 / CVE-2019-10401 Stored XSS vulnerability in expandable textbox form control Medium SECURITY-1525 / CVE-2019-10402 XSS vulnerability in combobox form control Medium SECURITY-1537 1 / CVE-2019-10403 Stored XSS vulnerability in SCM tag...

CVE-2019-14458

VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header...

Design/Logic Flaw

VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header...

CVE-2019-14458

CVE-2019-14458 affects VIVOTEK IP Camera devices with firmware before 0x20x. The vulnerability allows a denial-of-service triggered by a crafted HTTP header. Exploit details, affected models/versions beyond the firmware threshold, and concrete remediation are not provided in the connected documen...

CVE-2019-14458: Undefined Security Weakness

VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header...

CVE-2016-10990

The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header...

Design/Logic Flaw

The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header...

CVE-2016-10990

The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header...

CVE-2019-16197

In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS...

Cross site scripting

In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS...

CVE-2019-16197

In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS...

Design/Logic Flaw

The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header...

CVE-2016-10964

CVE-2016-10964 affects the WordPress dwnldr plugin, versions before 1.01. The vulnerability is an XSS via the User-Agent HTTP header in the download handling logic. Public records include an unauthenticated stored XSS PoC and advisories noting the issue. Impact, as stated, is script execution whe...

CVE-2019-16197

CVE-2019-16197 affects Dolibarr 10.0.1, where the value of the HTTP User-Agent header is echoed into the HTML page in htdocs/societe/card.php, causing a reflected XSS. The vulnerability stems from copying header text between HTML tags, allowing potentially injected scripts to execute in the conte...

Dolibarr ERP-CRM 10.0.1 - User-Agent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Dolibarr ERP/CRM 10.0.1 - User-Agent Http Header Cross Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://www.dolibarr.org/ Software Link: https://www.dolibarr.org/downloads Version: 10.0.1...

CVE-2016-10964: Improper Neutralization of Input During Web Page Generation

The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header...

MGASA-2019-0277 Updated nodejs packages fix security vulnerabilities

This update provides nodejs v6.17.1 fixing at least the following security issues: The c-ares function aresparsenaptrreply, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer CVE-2017-1000381 Fix for 'path' module regular expression deni...