6841 matches found
Magento cross-site scripting vulnerability (CNVD-2018-04516)
Magento is an open source PHP e-commerce system from Magento, which provides permission management, search engine and payment gateway. Magento cross-site scripting vulnerability, attackers by enticing users to access malicious files to exploit the vulnerability to inject malicious JavaScript scri...
PT-2018-18194
Name of the Vulnerable Software and Affected Versions Voten.co versions prior to 2017-08-25 Description An issue was discovered in the bio field of a user profile, allowing for server-side template injection of arbitrary JavaScript due to an unescaped template literal in...
Cross-Site Scripting Vulnerability in EasySNS V1.6 Frontend
ESPHP development framework based on the development of EasySNS minimalist community for the new database architecture and program structure.ESPHP is a self-developed set of PHP source code framework. EasySNS V1.6 in the program implementation of cross-site scripting vulnerabilities, attackers ca...
Cross-site Scripting (XSS)
anywhere is vulnerable to cross-site scripting XSS attacks. The library uses a version of the serve-index package that is vulnerable to CVE-2015-8856, allowing a malicious user to inject and execute arbitrary Javascript...
HPE System Management 7.6.0.11 Cross Site Scripting
Product: HPE System Management Homepage Versions: 7.6.0.11 and minor versions Vulnerability: JavaScript Injection in file gsearch.php, parameter prod OWASP TOP 10: A1 Injection Type: Javascript Injection Impact: Allows an attacker to perform an XSS Cross-Site Scripting attack, execute arbitrary...
PT-2018-5719
Name of the Vulnerable Software and Affected Versions: NetIQ Access Manager versions prior to 4.3.3 Description: A cross-site scripting issue exists in the handling of the ESP login parameter, allowing an attacker to inject JavaScript code into the login page. Recommendations: For versions prior ...
CVE-2017-14799: Improper Neutralization of Input During Web Page Generation
A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into the login page...
IBM WebSphere Portal Cross-Site Scripting Vulnerability (CNVD-2018-06508)
IBM WebSphere Portal is a suite of enterprise portal software from IBM. The software creates a platform that connects an organization internally and externally, allowing employees, customers and suppliers to access internal data through the platform. A cross-site scripting vulnerability exists in...
MyBB Cross-Site Scripting Vulnerability (CNVD-2018-05067)
MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB version 1.8.14. A remote attacker can use the...
IBM Connections Cross-Site Scripting Vulnerability (CNVD-2018-03881)
IBM Connections is a suite of social software platforms from IBM in the United States. The platform provides advanced analytics and real-time data monitoring capabilities, and accelerates web collaboration within and outside the organization through IBM SmartCloud services. A cross-site scripting...
IBM Rhapsody Design Manager Cross-Site Scripting Vulnerability
IBM Rhapsody Design Manager DM is a suite of collaborative design management software from IBM. The software supports the use of centralized system repositories with Web-based access to store, share, search, and manage design models, as well as software to automate design reviews. A cross-site...
IBM Maximo Anywhere Cross-Site Scripting Vulnerability
IBM Maximo Anywhere is a suite of next-generation mobile solutions from IBM USA built on the IBM Worklight platform. The solution supports remote access to IBM Maximo Asset Management a comprehensive asset lifecycle and maintenance management solution workflow and asset management via mobile...
IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2018-05823)
IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A cross-site...
CVE-2018-1415
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138821...
PT-2018-12342
Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management version 7.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...
CVE-2017-18092
CVE-2017-18092 affects Atlassian Crucible; the print snippet resource is vulnerable to cross-site scripting (XSS) via the contents of a comment on the snippet, in versions before 4.4.3 (the fixed 4.4.x line) and before 4.5.0. The underlying issue is rendering user-supplied comment content, allowi...
CVE-2017-18092: Improper Neutralization of Input During Web Page Generation
The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...
CVE-2017-18093: Improper Neutralization of Input During Web Page Generation
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the location...
CVE-2017-18089: Improper Neutralization of Input During Web Page Generation
The view review history resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the invited reviewers for a review...