Cross-site Scripting (XSS)

HAPI FHIR TestPage Overlay is vulnerable to cross-site scripting XSS. The parameters passed through the HTTP request to be displayed in a form page are not sanitized, allowing an attacker to inject a malicious script...

Cross site scripting

A reflected Cross-Site-Scripting XSS vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests...

CVE-2019-5588

A reflected Cross-Site-Scripting XSS vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests...

CVE-2019-5586

A reflected Cross-Site-Scripting XSS vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "param" parameter of the error process HTTP requests...

Cross site scripting

A Cross-site Scripting XSS vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling...

ZEIT: Stored XSS in profile page

Summary: There is a stored XSS vulnerability in the users profile page. Steps To Reproduce: 1. Go to https://zeit.co/login and login. 2. Go to https://zeit.co/profile/username/edit 3. Enter any value in the field which shows name 4. Intercept it burp and send it to repeater. 5. Then change the na...

CVE-2018-20487

An issue was discovered in the firewall3 component in Inteno IOPSYS 1.0 through 3.16. The attacker must make a JSON-RPC method call to add a firewall rule as an "include" and point the "path" argument to a malicious script or binary. This gets executed as root when the firewall changes are...

Stored cross-site scripting vulnerability in PHPOK up***_co***.php file

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. A stored cross-site scripting vulnerability exists in the PHPOK upco.php file. An attacker can insert malicious js code into the page to obtain user cookies and other information, leading to user hijacking...

Cross-Site Scripting (XSS)

Apache Tomcat is vulnerable to cross-site scripting XSS. The appdev/sample/web/hello.jsp example application does not sanitize the user provided input, allowing a remote attacker to inject malicious web script or HTML into a victim's browser via the test parameter...

F5 Networks BIG-IP : BIG-IP ASM XSS vulnerability (K14812883)

This is a stored cross-site scripting XSS vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF, which results in code execution as the admin user. CVE-2019-6607 The user levels that can store this attack are ASM Administrator,...

CVE-2019-6565

Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script...

File Upload Vulnerability in eZiosuite eLearning Platform

eZiosuite online teaching platform is the central system of the whole digital learning, which is a digital learning platform integrating course management, online preparation and production of network courses, course teaching, course resource sharing, and teacher-student interaction. A file uploa...

Cross-site Scripting (XSS)

bootstrap is vulnerable to Cross-site Scripting XSS. The attack exists because it does not escape the data-template, data-content and data-title options for tooltip/popover plugins, allowing to inject malicious script through it...

Cross-site Scripting (XSS)

modx/revolution is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize user photo field, allowing the attacker to inject malicious script through it...

X (Formerly Twitter): Stored XSS on reports.

Summary: Stored XSS can be submitted on reports, and anyone who will check the report the XSS will trigger. Description: Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application...

CVE-2018-1000874

PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by crafting a...

StatCounter Analytics Code Hijacked to Steal Bitcoins from Cryptocurrency Users

Late last week an unknown hacker or a group of hackers successfully targeted a cryptocurrency exchange with an aim to steal Bitcoins by compromising the web analytics service it was using. ESET malware researcher Matthieu Faou this weekend spotted malicious JavaScript code on up to 700,000 websit...

StatCounter Analytics Code Hijacked to Steal Bitcoins from Cryptocurrency Users

Late last week an unknown hacker or a group of hackers successfully targeted a cryptocurrency exchange with an aim to steal Bitcoins by compromising the web analytics service it was using. ESET malware researcher Matthieu Faou this weekend spotted malicious JavaScript code on up to 700,000 websit...

Frida-Wshook - Script Analysis Tool Based On Frida.re

frida-wshook is an analysis and instrumentation tool which uses frida.re to hook common functions often used by malicious script files which are run using WScript/CScript. The tool intercepts Windows API functions and doesn't implement function stubs or proxies within the targeted scripting...

malayalam.filmibeat.com XSS vulnerability

Open Bug Bounty ID: OBB-687350 Description| Value ---|--- Affected Website:| malayalam.filmibeat.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...