CVE-2018-8031

CVE-2018-8031 describes a Cross-site Scripting (XSS) vulnerability in the Apache TomEE console (tomee-webapp). The issue could allow arbitrary JavaScript execution when a user visits a malicious URL. TomEE bundles without this application or after setup, the UI can be removed to mitigate exposure...

PT-2018-18395

Name of the Vulnerable Software and Affected Versions: Apache TomEE versions prior to 7.0.5 Description: The Apache TomEE console has a XSS issue that could allow javascript to be executed if a user is given a malicious URL. This web application is used to add TomEE features to a Tomcat...

PT-2018-15192

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.132 and earlier Jenkins versions 2.121.1 and earlier Description A cross-site scripting issue exists in the Stapler web framework's org/kohsuke/stapler/Stapler.java, allowing attackers who can control certain URLs in Jenkins...

CVE-2018-10891

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank...

Microsoft Web Customization for ADFS CVE-2018-8326 Cross Site Scripting Vulnerability

Description Microsoft Web Customization for ADFS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected...

CVE-2018-10891: Improper Input Validation

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank...

PT-2018-10163

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.5.1 Moodle versions prior to 3.4.4 Moodle versions prior to 3.3.7 Moodle versions prior to 3.1.13 Description A flaw was found in the software. When a quiz question bank is imported, it is possible for the question...

OCS Inventory NG Cross-Site Scripting Vulnerability (CNVD-2018-12876)

OCS Inventory NG Open Computer and Software Inventory Next Generation is a Asset Management software developed by OCS Inventory team. The software helps administrators master computer software installation and configuration, as well as low network traffic communication between HTTP proxies and...

Umbraco CMS SeoChecker Plugin 1.9.2 - Cross-Site Scripting

Author Information Author : Ahmed Elhady Mohamed twitter : @AhmedELhady Date : 01/07/2018 Software Information Affected Software : SeoChecker Umbraco CMS Plug-in Version: version 1.9.2 Software website : https://soetemansoftware.nl/seo-checker Description SeoChecker Umbraco CMS Plug-in version...

PT-2018-10510

Name of the Vulnerable Software and Affected Versions Jirafeau versions prior to 3.4.1 Description The issue affects the shared files description file, allowing the execution of a JavaScript payload when an administrator searches or lists uploaded files. This is due to two stored Cross-Site...

CVE-2018-3747

The public node module versions = 1.0.3 allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript...

CVE-2018-3747

The public node module versions = 1.0.3 allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript...

CVE-2018-3748

There is a Stored XSS vulnerability in the glance node module versions element allows to execute JavaScript code against any user who opens a directory listing containing such crafted file name...

PT-2018-16168

Name of the Vulnerable Software and Affected Versions public versions prior to 0.1.4 public versions = 1.0.3 Description The issue allows embedding HTML in file names, which under certain conditions might lead to the execution of malicious JavaScript. This is due to the failure to sanitize...

PT-2018-16169

Name of the Vulnerable Software and Affected Versions glance versions element. This is only exploitable if the attacker can control the name of a file served by the glance package. Recommendations For glance versions = 3.0.5, update to version 3.0.8 or later. For glance versions prior to 3.0.8,...

CVE-2018-1000516

The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting XSS attacks. In this form of attack,...

CVE-2018-1000513

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting XSS vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x...

CVE-2018-1000516

The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting XSS attacks. In this form of attack,...

Cross site scripting

The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting XSS attacks. In this form of attack,...

PYSEC-2018-149

The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting XSS attacks. In this form of attack,...