159 matches found
The vulnerability of the eDocLib platform for storing and processing corporate data arises from the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out cross-site scripting attacks.
The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect the structure of its web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser by placing it in a speciall...
CVE-2019-13971
OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request...
CVE-2019-13971: Improper Neutralization of Input During Web Page Generation
OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request...
PT-2019-13500
Name of the Vulnerable Software and Affected Versions OTCMS version 3.81 Description The issue allows for XSS via the mode parameter in an "apiRun.php?mudi=autoRun" request. Recommendations For OTCMS version 3.81, avoid using the mode parameter in the "apiRun.php?mudi=autoRun" request until the...
CVE-2018-14875
An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. Reflected XSS exists with an authenticated session via the Customerid, formName, FrameId, or MODE parameter...
CVE-2018-14875
An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. Reflected XSS exists with an authenticated session via the Customerid, formName, FrameId, or MODE parameter...
Cross site scripting
An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. Reflected XSS exists with an authenticated session via the Customerid, formName, FrameId, or MODE parameter...
PT-2018-2944
Name of the Vulnerable Software and Affected Versions eDocLib affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the eDocLib platform for storing and processing corporate data. This allows a remote attacker to execute arbitrary...
CVE-2018-5651
An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php darkmodestart parameter...
CVE-2016-10084
admin/batchmanager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page'tab' variable aka the mode parameter...
PT-2016-4573
Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.8.4 Description The issue allows remote authenticated administrators to conduct File Inclusion attacks. This is achieved via the page'tab' variable, also known as the mode parameter, in the admin/batch manager.php...
CVE-2016-10084: Improper Access Control
admin/batchmanager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page'tab' variable aka the mode parameter...
Dream Multimedia DreamBox DM500-S Cross-Site Scripting Vulnerability
Dream Multimedia DreamBox DM500-S is a Linux-based digital TV set-top box receiver from Dream Multimedia, Germany. A cross-site scripting vulnerability exists in the Dream Multimedia DreamBox DM500-S. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or HTML v...
CVE-2015-4714
Cross-site scripting XSS vulnerability in the DreamBox DM500-S allows remote attackers to inject arbitrary web script or HTML via the mode parameter to /body...
PT-2015-6676
Name of the Vulnerable Software and Affected Versions DreamBox DM500-S affected versions not specified Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the mode parameter to the "/body" API endpoint. Recommendations For DreamBox...
CVE-2015-4714: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the DreamBox DM500-S allows remote attackers to inject arbitrary web script or HTML via the mode parameter to /body...
PT-2014-5466
Name of the Vulnerable Software and Affected Versions Katello affected versions not specified Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, through two vulnerable parameters: - the mode parameter in the setup utils function in content...
CVE-2014-4555: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter...
PT-2014-5974
Name of the Vulnerable Software and Affected Versions Style It plugin versions 1.0 and earlier for WordPress Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the mode parameter in the fonts/font-form.php file. Recommendation...