Cross site scripting

Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element, related to...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to...

Tiki Cross-Site Request Forgery Vulnerability (CNVD-2017-30070)

Tiki is a free, free, open source web application with rich built-in functionality. A cross-site request forgery vulnerability exists in the IMG element of Tiki, which can be exploited by an authenticated user to gain administrator privileges if the administrator opens a Wiki page with the IMG...

CVE-2017-14924

CVE-2017-14924 is a CSRF vulnerability in the Tiki wiki system where an authenticated user can gain administrator privileges by loading an IMG element on a wiki page (tiki-assignuser.php). Affected versions: before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS. Mitig...

CVE-2017-14921

CVE-2017-14921 is a stored XSS in the Filemanager component of Tine 2.0 Community Edition prior to 2017.08.4. An authenticated user can inject JavaScript via an IMG element in the Filename field, which is rendered by the admin/viewer context and by other users, enabling script execution. The vuln...

CVE-2017-14925

Cross-Site Request Forgery CSRF vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element, related to...

CVE-2017-14922

Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users...

CVE-2017-14921

Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users...

CVE-2017-14924

Cross-Site Request Forgery CSRF vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to...

CVE-2017-14922

CVE-2017-14922 describes a stored XSS in Tine 2.0 Community Edition prior to 2017.08.4. An authenticated user can inject JavaScript via an IMG element in History views (Profile, Calendar, Tasks, CRM); the payload is mishandled during rendering by admins and other users. The affected software is T...

CVE-2017-14923

The CVE-2017-14923 issue affects Tine 2.0 Community Edition prior to 2017.08.4, exposing a Stored XSS via an IMG element in the Leadname field. An authenticated user can inject JavaScript that is mishandled when rendered by admins and other users. CVSS data in the records indicates a MEDIUM base ...

CVE-2017-14925

CVE-2017-14925 affects Tiki Wiki before certain versions (16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, 15 LTS before 15.5 LTS). The vulnerability is a Cross-Site Request Forgery (CSRF) via an IMG element, related to tiki-objectpermissions.php, enabling an authenticated user to edit global per...

CVE-2017-11617

Cross-site scripting XSS vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of an email via an IMG element with both single quotes and double quotes...

Cross site scripting

Cross-site scripting XSS vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of an email via an IMG element with both single quotes and double quotes...

CVE-2017-11617

Cross-site scripting XSS vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of an email via an IMG element with both single quotes and double quotes...

CVE-2017-6589

EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document...

CVE-2017-6589

EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document...

CVE-2016-7119

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

Cross site scripting

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...