PT-2021-8977

Name of the Vulnerable Software and Affected Versions Moodle versions 3.5 through 3.5.7 Moodle versions 3.6 through 3.6.5 Moodle versions 3.7 through 3.7.1 Description A vulnerability was found where javaScript injection was possible in some Mustache templates via recursive rendering from context...

CVE-2019-10670

An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqliescaperealstring for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these...

CVE-2019-10670: Improper Neutralization of Input During Web Page Generation

An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqliescaperealstring for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these...

Cross-Site Scripting (XSS)

status-board is vulnerable to cross-site scripting XSS. The error 404 message is not sanitized, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser via the safeDashboardName parameter...

Cross-site Scripting (XSS)

anahkiasen/former is vulnerable to cross-site scripting XSS. The vulnerability exists as the value $value in Checkable.php is not sanitized, allowing a remote attacker to inject arbitrary Javascript into a victim's browser through the affected parameters...

CVE-2014-10391

The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection...

CVE-2014-10394

The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...

Design/Logic Flaw

The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection...

Code injection

The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...

CVE-2014-10391

The CVE-2014-10391 entry concerns the WordPress plugin WP Support Plus Responsive Ticket System, specifically versions prior to 4.1. The vulnerability is a JavaScript injection (XSS) flaw caused by insufficient validation of client-side data in the plugin. Impact is that an attacker could trigger...

CVE-2014-10391

The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection...

CVE-2014-10394

The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...

CVE-2014-10394

The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...

CVE-2014-10394

The CVE-2014-10394 entry affects the WordPress Rich Counter plugin prior to version 1.2.0. The vulnerability is a JavaScript injection resulting from a crafted User-Agent header, as documented across multiple sources (NVD entry and vendor/Red Hat references). The practical impact is an injection ...

CVE-2014-10394: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...

PT-2019-7070

Name of the Vulnerable Software and Affected Versions rich-counter plugin versions prior to 1.2.0 for WordPress Description The issue concerns JavaScript injection via a User-Agent header. This allows for malicious code execution. No information is provided about the estimated number of potential...

PT-2019-7067

Name of the Vulnerable Software and Affected Versions wp-support-plus-responsive-ticket-system plugin versions prior to 4.1 Description The issue concerns JavaScript injection in the wp-support-plus-responsive-ticket-system plugin for WordPress. Recommendations For versions prior to 4.1, update t...

CVE-2014-10391: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection...

CVE-2014-10386: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections...

IBM Cloud Private Cross-Site Scripting Vulnerability

IBM Cloud Private is a set of enterprise private cloud solutions from IBM USA. The product is built primarily on Kubernetes and container technology. A cross-site scripting vulnerability exists in IBM Cloud Private, which can be exploited by remote attackers to inject arbitrary JavaScript code in...