CVE-2017-1000482

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

CVE-2017-1000482

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

CVE-2017-1000478

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

CVE-2017-1000478

ELabftw 1.7.8 is vulnerable to a stored cross-site scripting (XSS) flaw in the experiment infos component. The issue arises from unsanitized input stored and executed in the browser, enabling arbitrary JavaScript execution and denial of service. No remediation or patch details are provided in the...

Leafpub Cross-Site Scripting Vulnerability

Leafpub is an open source PHP and MySQL based code publishing tool . A cross-site scripting vulnerability exists in Leafpub version 1.2.0-beta6. A remote attacker can exploit this vulnerability to cause a denial of service and execute JavaScript code...

CVE-2017-1000467: Improper Neutralization of Input During Web Page Generation

LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code...

Invoice Ninja Cross-Site Scripting Vulnerability

Invoice Ninja is an open source financial system. The system is able to provide invoicing, collection and other functions. A cross-site scripting vulnerability exists in the invoice creation page in Invoice Ninja version 3.8.1. A remote attacker can exploit this vulnerability to cause a denial of...

CVE-2017-1000478: Improper Neutralization of Input During Web Page Generation

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

CVE-2017-1000482: Improper Neutralization of Input During Web Page Generation

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

PT-2018-5246

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1 Description The issue allows an attacker to potentially trick users into accessing malicious sites or executing attacker-controlled JavaScript after logging in, by exploiting the redirect mechanism that uses t...

PT-2018-5230

Name of the Vulnerable Software and Affected Versions Leafpub version 1.2.0-beta6 Description The issue allows for stored cross-site scripting, which can be triggered within the edit blog post page. This can lead to disruption of service and execution of javascript code. Recommendations For Leafp...

PT-2018-5247

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1 Description The issue allows a member of the Plone site to set JavaScript in the home page property of their profile. This JavaScript is executed when a visitor clicks the home page link on the author page...

PT-2018-5234

Name of the Vulnerable Software and Affected Versions LavaLite version 5.2.4 Description The issue concerns a stored cross-site scripting vulnerability within the blog creation page. This can lead to disruption of service and allow the execution of javascript code. Recommendations For LavaLite...

CVE-2017-1000466: Improper Neutralization of Input During Web Page Generation

Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code...

PT-2018-5233

Name of the Vulnerable Software and Affected Versions Invoice Ninja version 3.8.1 Description The issue allows for stored cross-site scripting, which can be triggered within the invoice creation page. This can lead to disruption of service and execution of javascript code. Recommendations For...

PT-2018-5229

Name of the Vulnerable Software and Affected Versions BookStack version 0.18.4 Description The issue allows for stored cross-site scripting within the page creation page, potentially resulting in disruption of service and execution of javascript code. Recommendations For BookStack version 0.18.4,...

CVE-2017-1000462: Improper Neutralization of Input During Web Page Generation

BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code...

CVE-2017-7846

It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View - Feed article - Website" or in the standard format of "View - Feed article - default format". This vulnerability affects Thunderbird 52.5.2...

Updated thunderbird packages fix security vulnerabilities

Multiple vulnerabilities have been fixed in thunderbird. JavaScript Execution via RSS in mailbox:// origin CVE-2017-7846. Local path string can be leaked from RSS feed CVE-2017-7847. RSS Feed vulnerable to new line Injection CVE-2017-7848. Mailsploit From address with encoded null character is cu...

MGASA-2017-0477 Updated thunderbird packages fix security vulnerabilities

Multiple vulnerabilities have been fixed in thunderbird. JavaScript Execution via RSS in mailbox:// origin CVE-2017-7846. Local path string can be leaked from RSS feed CVE-2017-7847. RSS Feed vulnerable to new line Injection CVE-2017-7848. Mailsploit From address with encoded null character is cu...