Cross site scripting

In TinyWebGallery v2.4, an XSS vulnerability is located in the mkname, mkitem, and item parameters of the Add/Create module. Remote attackers with low-privilege user accounts for backend access are able to inject malicious script codes into the TWG Explorer item listing. The request method to...

CVE-2017-16635

In TinyWebGallery v2.4, an XSS vulnerability is located in the mkname, mkitem, and item parameters of the Add/Create module. Remote attackers with low-privilege user accounts for backend access are able to inject malicious script codes into the TWG Explorer item listing. The request method to...

Cross site scripting

Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the...

Bumper to bumper shopping app has a logic design flaw

Bumper to Bumper App is an online shopping application. There is a logic design vulnerability in BumperBuy APP. Attackers can register any account, reset any password, insert malicious js code in the personal information page, obtain user cookies and other information through packet bursting...

XSS vulnerability in Orange Deer Bike app

Orange Deer Bike app is a bike sharing application. An XSS vulnerability exists in the "Feedback" section of the Orange Deer Bike app. An attacker can insert malicious js code into the page to obtain user cookies and other information, leading to user hijacking...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2017-32686)

Adobe ColdFusion is a dynamic Web server product that runs CFML which is a programming language for Web applications. A cross-site scripting vulnerability exists in Adobe ColdFusion, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be...

ForgeRock OpenIDM Admin UI Cross-Site Scripting Vulnerability (CNVD-2017-30829)

ForgeRock OpenIDM is an extensible set of identity management tools for managing identity lifecycle and provisioning issues. A cross-site scripting vulnerability in the ForgeRock OpenIDM Admin UI allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which c...

DokuWiki /inc/parser/xhtml.php file cross-site scripting vulnerability

DokuWiki is a PHP-based Wiki engine. A cross-site scripting vulnerability exists in the DokuWiki /inc/parser/xhtml.php file, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user...

CVE-2017-7556

Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...

Cross site request forgery (csrf)

Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...

CVE-2017-7556

Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...

CVE-2017-7556

Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...

CVE-2017-9655

A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker may be able to upload a malicious script that attempts to redirect users to a...

Cross site scripting

A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker may be able to upload a malicious script that attempts to redirect users to a...

CVE-2017-9655

A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker may be able to upload a malicious script that attempts to redirect users to a...

CVE-2017-7556

It was found that hawtio contains a CSRF flaw that allows unrelated websites to perform actions as the authenticated user. Attackers could use this vulnerability to trick the user to visit his website that contains a malicious script which can be submitted to hawtio server on behalf of the user...

Cross-site Scripting (XSS)

Overview com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Cross-site Scripting XSS via an invalid portletId. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious...

MySQL Dumper Cross-Site Scripting Vulnerability

MySQL Dumper is a MySQL database backup script written in PHP and Perl. A cross-site scripting vulnerability in MySQL Dumper allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...

kitto cross-site scripting vulnerability

kitto is an interactive dashboard framework written using Elixir. A cross-site scripting vulnerability exists in the kitto 404 page, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user...

Apache OpenMeetings Cross-Site Scripting Vulnerability (CNVD-2017-23479)

Apache OpenMeetings is audio and video conferencing software. Apache OpenMeetings suffers from a cross-site scripting vulnerability in its implementation, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to...