CVE-2017-14922

CVE-2017-14922 describes a stored XSS in Tine 2.0 Community Edition prior to 2017.08.4. An authenticated user can inject JavaScript via an IMG element in History views (Profile, Calendar, Tasks, CRM); the payload is mishandled during rendering by admins and other users. The affected software is T...

PT-2017-13754

Name of the Vulnerable Software and Affected Versions eGroupware Community Edition versions prior to 16.1.20170922 Description The issue allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the application...

Cross-Site Scripting (XSS)

Pypeline is vulnerable to cross-site scriptingXSS attacks. The Python library allows the passing of Javascript to the Markup processor...

The vulnerability of the “/com.sap.portal.design.datamigration.LogPortalComponent” component of the SAP NetWeaver software integration platform allows a hacker to inject any HTML tags into the page.

The vulnerability of the “/com.sap.portal.design.datamigration.LogPortalComponent” component of the SAP NetWeaver software integration platform exists due to the lack of measures taken to protect the structure of the web page. This vulnerability allows a malicious actor to inject arbitrary HTML...

The vulnerabilities of the components “/com.sap.portal.themes.integrity.personalization”, “/com.sap.portal.themes.integrity.url”, and “/com.sap.portal.themes.integrity.serverFrameworkCockpit” of the SAP NetWeaver software integration platform allow a malicious individual to inject arbitrary HTML tags into a page.

The vulnerability of the components “/com.sap.portal.themes.integrity.personalization”, “/com.sap.portal.themes.integrity.url”, and “/com.sap.portal.themes.integrity.serverFrameworkCockpit” of the SAP NetWeaver software integration platform exists due to the lack of measures taken to protect the...

IBM Business Process Manager Cross-Site Scripting Vulnerability (CNVD-2017-34480)

IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A cross-site scripting vulnerability exists in IBM...

IBM Business Process Manager Cross-Site Scripting Vulnerability (CNVD-2017-34482)

IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A cross-site scripting vulnerability exists in IBM...

PT-2017-13323

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 8.0.1.1 through 8.5.7 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

IBM Business Process Manager Cross-Site Scripting Vulnerability

IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A cross-site scripting vulnerability exists in IBM...

PT-2017-13315

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager version 8.5.7 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

Stored Cross-Site Scripting Vulnerability in the YoYo Housing App

YouYouGoodHouse app is a rental app created by Chengdu GoodHouse Technology Co. A stored cross-site scripting vulnerability exists in the "About Us" section of the YouYouHaoRooms app. An attacker can insert malicious js code into the page to obtain user cookies and other information, resulting in...

CVE-2017-14615

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the...

Design/Logic Flaw

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the...

CVE-2017-4926

VMware vCenter Server 6.5 prior to 6.5 U1 contains a vulnerability that may allow for stored cross-site scripting XSS. An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page...

Advanced Man In The Middle Framework: Xerosploit

Xerosploit is a penetration testing toolkit whose goal is to perform man in the middle attacks for penetration testing purposes. It brings various modules together that will help you perform very efficient attacks. You can also use it to perform denial of service attacks and port scanning. Powere...

PT-2017-12288

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal and Web Content Manager versions 6.1, 7.0, and 8.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure...

PT-2017-11656

Name of the Vulnerable Software and Affected Versions IBM Emptoris Supplier Lifecycle Management version 10.1.0.x Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

Command injection

The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell...

Cross-site Scripting (XSS)

automattic/jetpack is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary JavaScript through the modules/shortcodes/polldaddy.php file as it does not properly sanitize the uniqueid parameter...

CVE-2015-2210: Improper Neutralization of Special Elements used in a Command

The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell...