6849 matches found
Download Plugins and Themes from Dashboard <= 1.5.0 - Unauthenticated Stored XSS
NinTechNet discovered a multiple security issues within the Download Plugins and Themes from Dashboard WordPress plugin. The plugin's setting update request did not check for authorisation, allowing an unauthenticated user to inject malicious JavaScript, which would be stored in the backend...
PT-2019-17109 · Ibm · Ibm Jazz Reporting Service
Name of the Vulnerable Software and Affected Versions: IBM Jazz Reporting Service JRS versions 6.0 through 6.0.6.1 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...
CVE-2019-16683
An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScript payload executes...
CVE-2019-3747
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users...
Magecart Group Targets Routers Behind Public Wi-Fi Networks
A faction of the Magecart threat group is testing code that targets routers used to provide free or paid Wi-Fi services in public spaces and hotels. If successful, attackers would able to compromise these commercial-grade routers and be able to siphon payment data of users joining Wi-Fi networks ...
CVE-2019-16525
An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code...
Dolibarr <= 10.0.1 XSS Vulnerability
Dolibarr is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dolibarr:dolibarr"...
PT-2021-8977
Name of the Vulnerable Software and Affected Versions Moodle versions 3.5 through 3.5.7 Moodle versions 3.6 through 3.6.5 Moodle versions 3.7 through 3.7.1 Description A vulnerability was found where javaScript injection was possible in some Mustache templates via recursive rendering from context...
CVE-2019-8450: Improper Neutralization of Input During Web Page Generation
Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a custom...
CVE-2019-10670
An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqliescaperealstring for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these...
CVE-2019-10670: Improper Neutralization of Input During Web Page Generation
An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqliescaperealstring for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these...
Cross-Site Scripting (XSS)
status-board is vulnerable to cross-site scripting XSS. The error 404 message is not sanitized, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser via the safeDashboardName parameter...
Cross-site Scripting (XSS)
anahkiasen/former is vulnerable to cross-site scripting XSS. The vulnerability exists as the value $value in Checkable.php is not sanitized, allowing a remote attacker to inject arbitrary Javascript into a victim's browser through the affected parameters...
CVE-2014-10391
The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection...
CVE-2014-10394
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...
Design/Logic Flaw
The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection...
Code injection
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...
CVE-2014-10391
The CVE-2014-10391 entry concerns the WordPress plugin WP Support Plus Responsive Ticket System, specifically versions prior to 4.1. The vulnerability is a JavaScript injection (XSS) flaw caused by insufficient validation of client-side data in the plugin. Impact is that an attacker could trigger...
