Cross site scripting

Cross-site scripting XSS vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment...

SAP NetWeaver Visual Composer Remote Code Injection Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A remote code injection vulnerability exists in SAP NetWeaver Visual Composer. An attacker could exploit the...

CVE-2017-6782

Cisco Prime Infrastructure (CPI) HTML Injection vulnerability CVE-2017-6782 allows an authenticated remote attacker to modify a page in the CPI administrative web interface due to improper sanitization of parameter values. Attack chain involves injecting code into an affected parameter and entici...

IBM Curam Social Program Management Remote Code Injection Vulnerability

IBM Curam Social Program Management SPM is a suite of social program management solutions from IBM USA. The solution supports the process of end-to-end social program delivery. A remote code injection vulnerability exists in IBM Curam SPM. An attacker could exploit this vulnerability to inject or...

CVE-2015-2690

CVE-2015-2690 affects FreePBX Digium Addons (digiumaddoninstaller) before 2.11.0.7. Multiple XSS flaws exist in views/add-license-form.php invoked via admin/config.php (type=setup, display=digiumaddons, page=add-license-form, addon=ffa). The attacker can inject script/HTML through any of 12 param...

CVE-2017-2285

The CVE affects WordPress plugin Simple Custom CSS and JS prior to version 3.4. A reflected cross-site scripting (CWE-79) vulnerability allows an attacker to inject arbitrary script, potentially executing in a logged-in user’s browser. The exact attack vectors aren’t specified in the provided doc...

CVE-2017-11460

CVE-2017-11460 is a cross-site scripting (XSS) vulnerability in the DataArchivingService servlet of SAP NetWeaver Portal 7.4. The issue allows remote attackers to inject arbitrary web script or HTML by manipulating the responsecode parameter in shp/shp_result.jsp. Public sources consistently desc...

SUSE-SU-2017:1893-1 Security update for evince

This update for evince fixes the following issues: - CVE-2017-1000083: Remote attackers could have used the comicbook mode of evince to inject shell code. bsc1046856, bgo784630...

SUSE-SU-2017:1894-1 Security update for evince

This update for evince fixes the following issues: - CVE-2017-1000083: Remote attackers could have used the comicbook mode of evince to inject shell code. bsc1046856, bgo784630...

PT-2017-3713

Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.6.0 and earlier Description: A Cross-Site Scripting issue allows attackers to execute unauthorized code or commands via the action input during the activation of a FortiToken. The vulnerability is caused by insufficient...

CVE-2017-1000032

Cross-Site scripting XSS vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parentid parameter to tree.php and drpaction parameter to datasources.php...

SAP GRC Remote Code Injection Vulnerability

SAP GRC is a suite of governance, risk management and compliance solutions from SAP Germany. SAP GRC suffers from a remote code injection vulnerability. It allows an attacker to inject arbitrary code...

Cross-site scripting vulnerability in phpLDAPadmin htdocs/entry_chooser.php file

phpLDAPadmin is a web-based LDAP client that allows easy management of LDAP servers. A cross-site scripting vulnerability exists in the htdocs/entrychooser.php file in phpLDAPadmin 1.2.3 and earlier versions. A remote attacker can inject code with the help of the 'form', 'element', 'rdn' or...

Android Framework Arbitrary Code Injection

The vulnerability of the software interface of the Android operating system’s Framework is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely, using a local malware application...

Android Framework Arbitrary Code Injection

The vulnerability of the software interface of the Android operating system’s Framework is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely, using a local malicious application...

nscd DoS Malicious Code

The vulnerability of the nscd library, which provides system calls and core functions of the glibc library, arises due to incorrect reading of the internal buffer size. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures or inject code by running the...

Code injection

libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service stack consumption via a crafted rule involving hex strings that is mishandled in the yrreemit function, a different vulnerability than CVE-2017-9304...

Cross site scripting

Cross-site scripting XSS vulnerability in FlipBuilder Flip PDF allows remote attackers to inject arbitrary web script or HTML via the currentHTMLURL parameter...

Logsign Remote Code Injection Vulnerability

Logsign is the next generation security information and event management solution for security intelligence, log management and easy compliance reporting. Logsign suffers from a remote code injection vulnerability. An attacker could exploit this vulnerability to execute arbitrary script code with...

CVE-2017-9140

The CVE-2017-9140 issue affects Telerik Reporting for ASP.NET WebForms (Telerik.ReportViewer.WebForms.dll) prior to R1 2017 SP2 (11.0.17.406). It is a reflected XSS vulnerability exploitable via the bgColor parameter to Telerik.ReportViewer.axd, allowing attacker-controlled script/HTML execution ...