Cross site scripting

Cross-site scripting XSS vulnerability on D-Link DIR-615 routers 20.07 allows an attacker to inject JavaScript into the "Status - Active Client Table" page via the hostname field in a DHCP request...

CVE-2018-15874

Cross-site scripting XSS vulnerability on D-Link DIR-615 routers 20.07 allows an attacker to inject JavaScript into the "Status - Active Client Table" page via the hostname field in a DHCP request...

CVE-2018-15875

Cross-site scripting XSS vulnerability on D-Link DIR-615 routers 20.07 allows attackers to inject JavaScript into the router's admin UPnP page via the description field in an AddPortMapping UPnP SOAP request...

CVE-2018-15874

The connected CNVD entry describes a Cross-Site Scripting (XSS) vulnerability in D-Link DIR-615 routers using version 20.07, exploitable by injecting JavaScript into the Status → Active Client Table via the hostname field in DHCP requests. Affected component: the DHCP hostname handling on DIR-615...

Cross-site scripting vulnerability in multiple IBM products (CNVD-2018-24626)

IBM Rational Collaborative Lifecycle Management CLM is a set of collaborative lifecycle management solutions.Rational Quality Manager RQM is a set of collaborative, web-based quality management solutions. IBM Rational Collaborative Lifecycle Management CLM is a collaborative lifecycle management...

Cross-Site Scripting (XSS)

This is Due to the unescaped quotes in dojox/Grid/DataGrid when editing rows, which would allow an attacker to inject arbitrary HTML and Javascript into a victim's browser. Which makes dojox vulnerable to cross-site scripting...

CVE-2018-10139

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

CVE-2018-10139

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

CVE-2018-10139

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

IBM Rhapsody Model Manager Cross-Site Scripting Vulnerability

IBM Rhapsody Model Manager is a suite of collaborative design model management software from IBM. The software supports the use of centralized system repositories for storing, sharing, searching and managing design models, as well as automated software design reviews. A cross-site scripting...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2018-14693)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A cross-site...

WordPress Mondula Multi Step Form Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . Mondula Multi Step Form is used in one of the drag-and-drop form builder plugin . A cross-site scripting...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2018-13986)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting vulnerability exists in IBM Sterling B...

Storage-based Cross-site Scripting Vulnerability in School Worry-free Enterprise Website System v1.7

School carefree enterprise website system Xiao5uCompany is a set of company and enterprise-oriented website building system. A stored cross-site scripting vulnerability exists in XiaowuCompany v1.7. An attacker can use the vulnerability to insert malicious js code into the page, obtain user cooki...

IBM Rational Rhapsody Design Manager and IBM Rational Software Architect Design Manager Cross-Site Scripting Vulnerabilities

IBM Rational Rhapsody Design Manager is collaborative design management software built on the IBM Jazz platform that helps design team members and stakeholders share, track, review, and manage designs.IBM Rational Software Architect Design Manager is a IBM Rational Software Architect Design Manag...

Atlassian JIRA Server Cross-Site Scripting Vulnerability (CNVD-2018-18120)

Atlassian JIRA Server is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of problems and defects in the work. A cross-site scripting vulnerability exists in the IncomingMailServers resource in Atlassian JIRA Server. A remote...

CVE-2017-17541

A Cross-site Scripting XSS vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature...

CVE-2018-5229

The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of user submitted add-on names...

macOS/iOS - JavaScript Injection Bug in OfficeImporter

QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code using OfficeImport and renders it using WebKit. The...

macOSiOS - JavaScript Injection Bug in OfficeImporter

macOSiOS - JavaScript Injection Bug in OfficeImporter QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code...