Design/Logic Flaw

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within SVG files is maintained when opening such files "in browser" based on our Mail or Drive app. In case of "a" tags, this may include link targets with base64 encoded "data" references. Malicious script code c...

Open redirect

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed...

Cross site scripting

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be execute...

Open redirect

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5. JavaScript code can be used as part of ical attachments within scheduling E-Mails. This content, for example an appointment's location, will be presented to the user at the E-Mail App, depending on the invitation workflow. Th...

Design/Logic Flaw

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as mp3 album covers. In case their XML structure contains script code, that code may get executed when calling the related cover URL. Malicious script code can be executed within a user's context. This c...

CVE-2016-6847

Open-Xchange OX App Suite prior to 7.8.2-rev8 is affected by CVE-2016-6847. The issue allows an attacker to embed script-enabled SVG files used as mp3 album covers; if the SVG XML includes script code, it may execute when the related cover URL is accessed, enabling code execution in the user’s br...

SAP NetWeaver AS Java XSS in GenericSemanticTest component

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java 7.4 Vendor URL: SAP Bugs: XSS Reported: 13.12.2016 Vendor response: 14.12.2016 Date of Public Advisory: 14.03.2017 Reference: SAP Security Note 2408100 Author: Boris Sanin ERPScan VULNERABILITY INFORMATION Class: XSS...

U.S. Dept Of Defense: XSS vulnerability on an Army website

A U.S. Army website was vulnerable to a cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. spam404 was able to demonstrate this vulnerability by crafting a specially formatted...

U.S. Dept Of Defense: Cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @r0p3 was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ramsexy was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ramsexy was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Reflected XSS on an Army website

A U.S. Army website was vulnerable to a cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. juliocesar was able to demonstrate this vulnerability by crafting a specially formatte...

U.S. Dept Of Defense: Reflected XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @r0p3 was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Reflected XSS on a Department of Defense website

A Department of Defense website was vulnerable to a reflected cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. juliocesar was able to demonstrate this vulnerability by craftin...

U.S. Dept Of Defense: Reflected XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @yaworskwas able to demonstrate this vulnerability by crafting a specially...

Mini Notice Board Cross-Site Scripting Vulnerability

Mini Notice Board 1.1 is an online bulletin board application that primarily facilitates the posting of trading announcements. A cross-site scripting vulnerability exists in the title and address parameters of the addcard.php page in Mini Notice Board 1.1. Due to the program failing to adequately...

CVE-2016-7095

Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution...

Design/Logic Flaw

Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution...

CVE-2016-7095

Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution...

Cisco IP Interoperability and Collaboration System Cross-Site Scripting Vulnerability

The Cisco IP Interoperability and Collaboration System is a set of solutions that provide voice interoperability across different systems based on IP standards. A cross-site scripting vulnerability exists in Cisco IP Interoperability and Collaboration System Universal Media Services, which can be...