10691 matches found
Liferay Portal CE /html/portal/flash.jsp page cross-site scripting vulnerability
Liferay Portal CE is an open source enterprise networking platform. The platform is used to build company operations, business solutions. A cross-site scripting vulnerability exists in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and earlier versions. A remote attacker can exploit...
Design/Logic Flaw
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...
Cross site scripting
Cross-site scripting XSS vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter...
CVE-2017-1000427
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...
CVE-2017-1000425
Cross-site scripting XSS vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter...
UBUNTU-CVE-2017-1000427
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...
DEBIAN-CVE-2017-1000427
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...
CVE-2017-1000427
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...
CVE-2017-1000425
CVE-2017-1000425 is a cross-site scripting vulnerability in Liferay Portal CE 7.0 GA4 and older, exploitable via a javascript: URI in the movie parameter of /html/portal/flash.jsp. Affected component: flash.jsp in the portal; root cause: insufficient input sanitization of the movie parameter lead...
CVE-2017-1000425
Cross-site scripting XSS vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter...
CVE-2017-1000427
CVE-2017-1000427: Marked up to version 0.3.6 and earlier is vulnerable to cross-site scripting via the data: URI parser. This is an XSS in user-supplied input that can execute script in the victim’s browser when a crafted URL is clicked. The NVD shows CVSS v3.0 base score 6.1 (network, low attack...
CVE-2017-1000427
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...
CVE-2017-1000427
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...
Mail.ru: XSS on e.mail.ru via postMessage
URI Get parameters based XSS in https://e.mail.ru/cgi-bin/login via combination of factors controllable script name via NUL characters inection, availability of script with known vulnerability within domain...
CVE-2017-14855
Red Lion HMI panels allow remote attackers to cause a denial of service software exception via an HTTP POST request to a long URI that does not exist, as demonstrated by version HMI 2.41 PLC 2.42...
Design/Logic Flaw
Red Lion HMI panels allow remote attackers to cause a denial of service software exception via an HTTP POST request to a long URI that does not exist, as demonstrated by version HMI 2.41 PLC 2.42...
CVE-2017-14855
Red Lion HMI panels allow remote attackers to cause a denial of service software exception via an HTTP POST request to a long URI that does not exist, as demonstrated by version HMI 2.41 PLC 2.42...
CVE-2017-15886
Server-side request forgery SSRF vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI...
Server side request forgery (ssrf)
Server-side request forgery SSRF vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI...