CVE-2017-1000463

Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in disruption of service and execution of javascript code...

CVE-2017-1000463: Improper Neutralization of Input During Web Page Generation

Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in disruption of service and execution of javascript code...

CVE-2017-1000193

October CMS build 412 is vulnerable to stored WCI a.k.a XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...

CVE-2017-1000193

October CMS build 412 is vulnerable to stored WCI a.k.a XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...

CVE-2017-1000193

October CMS 412 is reported to be vulnerable to a stored XSS (WCI) via the brand logo image name, allowing injected JavaScript to execute in the victim’s browser. The root cause, as described in the connected materials, is a stored XSS flaw in the brand logo handling. The documents do not specify...

CVE-2017-1000193: Improper Neutralization of Input During Web Page Generation

October CMS build 412 is vulnerable to stored WCI a.k.a XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...

PT-2017-14280

Name of the Vulnerable Software and Affected Versions Openfire Server versions prior to 4.1.7 Description The issue allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link. This can lead to session ID and data theft, bypassi...

PT-2017-12204

Name of the Vulnerable Software and Affected Versions ConnectWise Manage version 2017.5 Description The issue allows arbitrary client-side JavaScript code execution on victims who click on a crafted link. This involves a ContactCommon field in the services/system io/actionprocessor/Contact.rails...

Cross-site Scripting (XSS)

candy is vulnerable to cross-site scripting XSS attacks. Text sent by users is not sanitized in any way, allowing attackers to execute JavaScript code...

CVE-2017-1000033: Improper Neutralization of Input During Web Page Generation

Wordpress Plugin Vospari Forms version 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user...

CVE-2017-5157

CVE-2017-5157 affects Schneider Electric homeLYnk Controller (LSS100100) prior to v1.5.0. It is a cross-site scripting vulnerability where attacker-supplied input can execute JavaScript in a user’s browser. ICS-CERT advisory ICSA-17-019-01A notes CVSS v3.0 base score 6.3 and provides mitigations ...

Cross site scripting

Adobe Acrobat Chrome extension version 15.1.0.3 and earlier have a DOM-based cross-site scripting vulnerability. Successful exploitation could lead to JavaScript code execution...

CVE-2017-2929: Improper Neutralization of Input During Web Page Generation

Adobe Acrobat Chrome extension version 15.1.0.3 and earlier have a DOM-based cross-site scripting vulnerability. Successful exploitation could lead to JavaScript code execution...

PT-2017-15619

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Chrome extension versions 15.1.0.3 and earlier Description The issue is a DOM-based cross-site scripting vulnerability. Successful exploitation could lead to JavaScript code execution. Recommendations For Adobe Acrobat Chrome...

BahnSharing - Gruppentickets - External URLs, WebView JavaScript enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application BahnSharing - Gruppentickets published at the 'play' market has multiple vulnerabilities...

Firefox ESR Code Execution

The vulnerability of the HTMLVideoElement interface in browsers such as Firefox and Firefox ESR is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using JavaScript, thereby modifying the media elements’ tables...

CVE-2015-2727: Improper Input Validation

Mozilla Firefox 38.0 and Firefox ESR 38.0 allow user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions. NOTE: this vulnerability exists because of a...

CVE-2015-0801: Undefined Security Weakness

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818...

CVE-2015-0802: Undefined Security Weakness

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of ...

PT-2015-1040

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 37.0 Firefox ESR versions 31.x prior to 31.6 Thunderbird versions prior to 31.6 Description The issue is related to the incorrect restriction of resource: URLs, allowing a remote attacker to execute arbitrary...