CVE-2018-17886

An issue was discovered in JEESNS 1.3. The XSS filter in com.lxinet.jeesns.core.utils.XssHttpServletRequestWrapper.java could be bypassed, as demonstrated by a svg/onLoad=confirm substring. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-12429...

CVE-2018-17886: Improper Neutralization of Input During Web Page Generation

An issue was discovered in JEESNS 1.3. The XSS filter in com.lxinet.jeesns.core.utils.XssHttpServletRequestWrapper.java could be bypassed, as demonstrated by a...

PT-2018-14246

Name of the Vulnerable Software and Affected Versions JEESNS version 1.3 Description An issue was discovered in the XSS filter of JEESNS, where the filter could be bypassed. This is due to an incomplete fix for a previous issue. The bypass can be demonstrated using a substring such as...

CVE-2018-12429

JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie...

Cross site scripting

JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie...

CVE-2018-12429

JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie...

CVE-2018-12429

CVE-2018-12429 affects JEESNS up to version 1.2.1 and enables XSS by normal users publishing articles containing crafted payloads to capture an administrator cookie. Connected sources indicate the XSS filter in XssHttpServletRequestWrapper can be bypassed, and note that this vulnerability exists ...

CVE-2018-12429

JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie...

PT-2018-11164

Name of the Vulnerable Software and Affected Versions JEESNS versions prior to 1.3 Description The issue allows for XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie. Recommendations For JEESNS versions prior to 1.3, update...

CVE-2018-12429: Improper Neutralization of Input During Web Page Generation

JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie...