CVE-2018-8149: Improper Neutralization of Input During Web Page Generation

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft...

CVE-2017-18259: Improper Neutralization of Input During Web Page Generation

Dolibarr ERP/CRM is affected by stored Cross-Site Scripting XSS in versions through 7.0.0...

CVE-2018-1081: Improper Neutralization of Input During Web Page Generation

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...

CVE-2018-9172: Improper Neutralization of Input During Web Page Generation

The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes...

CVE-2018-0923: Improper Neutralization of Input During Web Page Generation

Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912,...

CVE-2017-15719: Improper Neutralization of Input During Web Page Generation

In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...

CVE-2017-5798: Improper Neutralization of Input During Web Page Generation

A Remote Code Execution vulnerability in HPE OpenCall Media Platform OCMP was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 for OCMP 3.x, all versions prior to 4.4.7 RP702 for OCMP 4.x...

CVE-2018-6380: Improper Neutralization of Input During Web Page Generation

In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system...

Trend Micro Smart Protection Server Multiple Vulnerabilities

1. Advisory Information Title: Trend Micro Smart Protection Server Multiple Vulnerabilities Advisory ID: CORE-2017-0008 Advisory URL:https://www.coresecurity.com/core-labs/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities Date published: 2017-12-19 Date of last update:...

CVE-2017-12346: Improper Neutralization of Input During Web Page Generation

Multiple vulnerabilities in Cisco Data Center Network Manager DCNM Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting...

CVE-2017-16798: Improper Neutralization of Input During Web Page Generation

In CMS Made Simple 2.2.3.1, the isfileacceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by...

CVE-2017-11777: Improper Neutralization of Input During Web Page Generation

Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting XSS vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka...

CVE-2015-5169: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Apache Struts before 2.3.20...

CVE-2015-3161: Improper Neutralization of Input During Web Page Generation

The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape tags in string literals when producing JSON...

CVE-2014-8753: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Cit-e-Net Cit-e-Access 6...

CVE-2017-1000006: Improper Neutralization of Input During Web Page Generation

Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue...

CVE-2015-6959: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Vindula 1.9...

CVE-2017-3557: Improper Neutralization of Input During Web Page Generation

Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite subcomponent: Print Server. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP t...

CVE-2016-6209: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Nagios...

CVE-2017-6503: Improper Neutralization of Input During Web Page Generation

WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS...