CVE-2018-1000813

Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting XSS vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an...

CVE-2018-1000842

FatFreeCRM version =0.15.0 =0.16.0 =0.17.0 =0.17.2, ==0.18.0 contains a Cross Site Scripting XSS vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on e...

CVE-2018-1000847

FreshDNS version 1.0.3 and prior contains a Cross Site Scripting XSS vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted string as their Ful...

PT-2018-9566

Name of the Vulnerable Software and Affected Versions FatFreeCRM versions =0.14.1 FatFreeCRM versions 0.15.0 through 0.15.1 FatFreeCRM versions 0.16.0 through 0.16.3 FatFreeCRM versions 0.17.0 through 0.17.2 FatFreeCRM version 0.18.0 Description The issue is a Cross Site Scripting XSS vulnerabili...

CVE-2018-1000842: Improper Neutralization of Input During Web Page Generation

FatFreeCRM version =0.15.0 =0.16.0 =0.17.0 =0.17.2, ==0.18.0 contains a Cross Site Scripting XSS vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on e...

PT-2018-9571

Name of the Vulnerable Software and Affected Versions FreshDNS versions 1.0.3 and prior Description The issue allows for the execution of an attacker's JavaScript code in a victim's session due to a Cross Site Scripting XSS vulnerability in the Account data form and Zone editor. This can be...

CVE-2018-1000826: Improper Neutralization of Input During Web Page Generation

Microweber version = 1.0.7 contains a Cross Site Scripting XSS vulnerability in Admin login form template that can result in Execution of JavaScript code...

CVE-2018-1000813: Improper Neutralization of Input During Web Page Generation

Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting XSS vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an...

CVE-2018-1000868: Improper Neutralization of Input During Web Page Generation

WeBid version up to current version 1.2.2 contains a Cross Site Scripting XSS vulnerability in userlogin.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must clic...

PT-2018-9590

Name of the Vulnerable Software and Affected Versions: WeBid versions up to 1.2.2 Description: The issue allows for Javascript execution in the user's browser and injection of malicious markup into the page due to a Cross Site Scripting XSS vulnerability in files such as user login.php and...

Pixars Tractor Cross-Site Scripting Vulnerability

Pixars Tractor is a web rendering solution. The product includes features such as resource sharing controls, Python module extensions, and more. A cross-site scripting vulnerability exists in Pixars Tractor 2.2 and prior versions, which can be exploited by remote attackers to inject and execute...

PT-2018-16947

Name of the Vulnerable Software and Affected Versions Pixar's Tractor software versions 2.2 and earlier Description The issue concerns a stored cross-site scripting problem in a field where users can add notes to existing nodes. This allows an attacker to insert Javascript code into the note fiel...

PT-2018-9540

Name of the Vulnerable Software and Affected Versions Grafana versions 5.2.4 and 5.3.0 Description The issue concerns a Cross Site Scripting XSS vulnerability in the Influxdb and Graphite query editor. This vulnerability can lead to the execution of arbitrary JavaScript code in the victim's...

CVE-2018-18342

Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

CVE-2018-18347

Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page...

Design/Logic Flaw

Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

CVE-2018-18347

Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page...

CVE-2018-18347: Improper Input Validation

Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page...

chromium-browser: Inappropriate implementation in Navigation

Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page...

chromium-browser: Out of bounds write in V8

Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...