Django MarkdownX Cross-Site Scripting Vulnerability

Django MarkdownX is a comprehensive Markdown plugin built for Django with flexibility, extensibility and ease of use at its core. A cross-site scripting vulnerability exists in Django MarkdownX version 4.0.2 that stems from a lack of proper cleanup of JavaScript elements. An attacker can exploit...

Huawei HarmonyOS and EMUI Mail Module Script Injection Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. A script injection vulnerability exists in the Huawei...

IBM Financial Transaction Manager for SWIFT Services Cross-Site Scripting Vulnerability (CNVD-2023-37163)

IBM Financial Transaction Manager for SWIFT Services is a financial transaction manager product from International Business Machines IBM. The product is primarily used for monitoring, tracking and reporting financial payments and transactions. A cross-site scripting vulnerability exists in IBM...

CVE-2022-41258

Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious script when running a common query in the Web Administration Console. On successful exploitation, an attacker can view or modify information causing a limited...

CVE-2021-34634

The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the solanlwphead function found in the /sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.23...

CVE-2015-0128

Technical details about CVE-2015-0128 are not publicly available in the provided connected documents. The materials reiterate the XSS description and affected IBM Rational Quality Manager versions; monitor for updates.

TextFileBB 1.0.16 Multiple Tag Script Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/17750/info TextFileBB is prone to multiple script-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated...

SA-CONTRIB-2012-140 - Inf08 - Cross Site Scripting (XSS)

Inf08 is a valid XHTML 1.0 Strict / CSS 2.1 theme ported from the free CSS template. The theme contains an arbitrary script injection vulnerability XSS due to the fact that it fails to sanitize user supplied taxonomy vocabulary names before display. This vulnerability is mitigated by the fact tha...

CVE-2011-1890

CVE-2011-1890 describes a Cross-Site Scripting (XSS) vulnerability in EditForm.aspx of Microsoft SharePoint Server 2010 and SharePoint Foundation 2010. The vulnerability allows a remote attacker to inject arbitrary web script or HTML via a POST, enabling XSS in affected SharePoint pages. Connecte...

CVE-2009-3956

The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a "script injection vulnerability," as demonstrated by Acrobat Forms Data...

CVE-2009-4148

DAZ Studio 2.3.3.161, 2.3.3.163, and 3.0.1.135 allows remote attackers to execute arbitrary JavaScript code via a 1 .ds, 2 .dsa, 3 .dse, or 4 .dsb file, as demonstrated by code that loads the WScript.Shell ActiveX control, related to a "script injection vulnerability."...

Design/Logic Flaw

DAZ Studio 2.3.3.161, 2.3.3.163, and 3.0.1.135 allows remote attackers to execute arbitrary JavaScript code via a 1 .ds, 2 .dsa, 3 .dse, or 4 .dsb file, as demonstrated by code that loads the WScript.Shell ActiveX control, related to a "script injection vulnerability."...

Microsoft Internet Explorer 8 Beta 1 - ieframe.dll Script Injection

Microsoft Internet Explorer 8 Beta 1 - ieframe.dll Script Injection source: https://www.securityfocus.com/bid/28581/info Microsoft Internet Explorer is prone to a script-injection vulnerability when handling specially crafted requests to 'acrerror.htm' via the 'res://' protocol. The file resides ...

CVE-2007-5459

CVE-2007-5459 concerns MouseoverDictionary (Firefox extension) prior to version 0.6.2. The cited sources indicate a cross-site scripting (XSS) vulnerability in the sidebar HTML page, allowing remote scripts to be executed in the user's browser via unspecified vectors. The vulnerability affects th...

Microsoft Windows Explorer Web View Script Injection Vulnerability

Description Microsoft Windows Explorer Web View is affected by an arbitrary script injection vulnerability. An attacker can exploit this issue by crafting a malicious file and placing it on a Web site or sending it to a user through email followed by enticing them to preview it in Windows Explore...

Ocean12 ASP Guestbook Manager v1.00

This advisory can be found at www.blacktigerz.org Subject: Ocean12 ASP Guestbook Manager v1.00. Description: Written entirely in ASP and VBScript this is a completely web-based, easy to install, ASP Guestbook Program. It stores data in an Access 2000 database and is configured 100 through the web...

FTLS Guestbook 1.1 - Script Injection

FTLS Guestbook 1.1 - Script Injection source: https://www.securityfocus.com/bid/6686/info Guestbook does not adequately filter HTML tags from various fields. This may enable an attacker to inject arbitrary script code into pages that are generated by the guestbook. The attacker's script code may ...

PHP-Nuke 6.0 - Web Mail Script Injection

PHP-Nuke 6.0 - Web Mail Script Injection source: https://www.securityfocus.com/bid/6400/info A vulnerability has been discovered in the PHP-Nuke web mail module. Due to insufficient sanitization of HTML emails it is possible for an attacker to embed script code into malicious messages. Opening an...

ECHU Alert #3 : Meunity 1.1 script injection vulnerability

---------------------------------------------- | Meunity 1.1 script injection vulnerability | ---------------------------------------------- PROGRAM: Meunity Community System VULNERABLE VERSIONS: all IMMUNE VERSIONS: none SEVERITY: really high Tested version ============== Meunity Community Syste...

Geeklog 1.3.5 - Calendar Event Form Script Injection

Geeklog 1.3.5 - Calendar Event Form Script Injection source: https://www.securityfocus.com/bid/4974/info Geeklog does not sufficiently sanitize script code from form fields, making it prone to script injection attacks. Attacker-supplied script code may potentially end up in webpages generated by...