Cross-Site Scripting (XSS)

dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The datatoexport parameter in /exports/export.php is not properly sanitized, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the...

Cross-Site Scripting (XSS)

craftcms/cms is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user via the title parameter...

Cross-Site Scripting (XSS)

github.com/go-gitea/gitea is vulnerable to cross-site scripting XSS. The avatar URL is not HTML encoded when initCommentForm creates its elements. This allows a remote attacker to inject arbitrary Javascript into a victim's browser using a malformed avatar URL to steal session tokens or perform...

Cross-Site Scripting (XSS)

easymon is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the check name parameter to steal session tokens or perform unwanted actions on behalf of the user...

Cross-Site Scripting (XSS)

intelliants/subrion CMS is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the Site Title parameter in panel/configuration/general, to steal session tokens or perform unwanted action on behalf of the user...

Cross-Site Scripting (XSS)

dnn.platform is vulnerable to cross-site scripting. The return URL is not sanitized which allows for remote attackers to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...

CVE-2018-13352

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...

CVE-2018-13352

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...

CVE-2018-13352

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...

PT-2018-11772

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to view active session tokens in a world-readable directory, potentially exposing user sessions. Recommendations For TerraMaster TOS version 3.1.03, consider restricting...

CVE-2018-13352: Exposure of Sensitive Information to an Unauthorized Actor

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...

Cross-Site Scripting (XSS)

validator is vulnerable to cross-site scripting. A remote attacker is able to bypass the XSS filters via UI redressing to inject arbitrary Javascript into a victim’s browser to steal session tokens or perform unwanted actions on behalf of the user...

Cross-Site Scripting (XSS)

validator is vulnerable to cross-site scripting. A remote attacker is able to bypass the Javascript filter via a crafted URL to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...

Cross-Site Scripting (XSS)

Dojo Toolkit is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of a user...

Cross-Site Scripting (XSS)

Plupload is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the id parameter to steal session tokens or perform unwanted actions on behalf of the user...

Cross-Site Scripting (XSS)

DotNetNuke.Core is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user via the dnnVariable parameter to the default URI...

Cross-Site Scripting (XSS)

Mortbay Jetty test web-app is vulnerable to cross-site scripting. The Dump Servlet does not output-sanitise before displaying on a user's browser. This allows a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of...

Cross-site Scripting (XSS)

loofah is vulnerable to a cross-site scripting XSS attack. A malicious user can pass an SVG file to the application to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...

Cross-Site Scripting (XSS)

resque is vulnerable to cross-site scripting. User input is not HTML encoded in lib/resque/server/views/queues.erb before displaying on a user's browser, which would allow remote attackers to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions o...

Cross-Site Scripting (XSS)

joi is vulnerable to cross-site scripting. The message parameter is not HTML encoded, which would allow an attacker to inject arbitrary Javascript code into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...