187 matches found
Cross-site Scripting in invenio-communities
Cross-Site Scripting XSS vulnerability in Jinja templates Impact A Cross-Site Scripting XSS vulnerability was discovered in two Jinja templates in the Invenio-Communities module. The vulnerability allows a user to create a new community and include script element tags inside the description and...
CVE-2018-19146
CVE-2018-19146 affects Concrete5 8.4.3. The issue is a stored XSS caused by config/concrete.php allowing administrators to upload SVG files that may contain HTML data with a SCRIPT element. Impact is an XSS vulnerability in Concrete5’s SVG handling, with no further exploit details or affected ver...
Cross site scripting
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
CVE-2018-16625
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
PT-2019-9360
Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description The issue allows for XSS via an SVG file with JavaScript in a SCRIPT element, specifically in the index.php/Admin/Uploaded component. Recommendations For version 5.1, consider restricting access to the...
CVE-2018-16625: Improper Neutralization of Input During Web Page Generation
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
UBUNTU-CVE-2018-18245
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified checkload plugin to NRPE...
Code injection
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified checkload plugin to NRPE...
CVE-2018-18245
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified checkload plugin to NRPE...
CVE-2018-18245
CVE-2018-18245 : Nagios Core 4.4.2 is vulnerable to a cross-site scripting (XSS) in the alert summary reports of plugin results, demonstrated by a SCRIPT element delivered via a modified check_load plugin to NRPE. The issue stems from user-facing output in the alert summary report, enabling injec...
CVE-2018-18245
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified checkload plugin to NRPE...
PT-2018-14377
Name of the Vulnerable Software and Affected Versions Nagios Core version 4.4.2 Description The issue concerns an XSS flaw in the alert summary reports of plugin results. This can be demonstrated by a SCRIPT element delivered by a modified check load plugin to NRPE, allowing for potential...
Design/Logic Flaw
panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
CVE-2018-16629
panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
PT-2018-13655
Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1 Description The issue allows for cross-site scripting XSS attacks via an SVG file containing JavaScript in a SCRIPT element, specifically affecting the "panel/uploads/elf l1 XA" endpoint. Recommendations For Subrion C...
CVE-2018-16629: Improper Neutralization of Input During Web Page Generation
panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
Cross site scripting
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...
CVE-2018-16729
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...
CVE-2018-16729: Improper Neutralization of Input During Web Page Generation
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...
CVE-2018-10799
A hang issue was discovered in Brave before 0.14.0 on, for example, Linux. This vulnerability is caused by the mishandling of a long URL formed by window.location+='?\u202a\uFEFF\u202b'; concatenation in a SCRIPT element...