3792 matches found
CVE-2019-15810: Improper Neutralization of Input During Web Page Generation
Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter...
PT-2019-14870
Name of the Vulnerable Software and Affected Versions kkcms version 1.3 Description The issue is related to a XSS vulnerability in the jx.php file, specifically with the url parameter. This allows for potential exploitation through the "/jx.php?url=" endpoint. Recommendations For kkcms version 1....
CVE-2019-11559
A reflected Cross-site scripting XSS vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component...
Cross site scripting
A reflected Cross-site scripting XSS vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component...
CVE-2019-11559
HRworks v1.16.1 is affected by CVE-2019-11559, a reflected XSS in the Login component triggered by a crafted URL parameter. Exploitation details are not provided in the connected sources, but the Red Hat advisory and PT-Security entry confirm the reflection-based script injection as the issue. PT...
CVE-2019-11559
A reflected Cross-site scripting XSS vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component...
CVE-2019-11559: Improper Neutralization of Input During Web Page Generation
A reflected Cross-site scripting XSS vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component...
CVE-2019-16317
In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different...
CVE-2017-18598
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php...
CVE-2017-18598: Improper Neutralization of Input During Web Page Generation
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php...
PT-2019-8529
Name of the Vulnerable Software and Affected Versions Qards plugin for WordPress versions through 2017-10-11 Description The issue allows for XSS via a remote document specified in the url parameter to "html2canvasproxy.php" API endpoint. Recommendations For Qards plugin for WordPress versions...
Design/Logic Flaw
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribepaged URL parameter...
CVE-2019-15109
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribepaged URL parameter...
CVE-2019-15109
The CVE-2019-15109 entry relates to WordPress plugin The Events Calendar (prior to version 4.8.2) and is caused by an XSS flaw in the tribe_paged URL parameter. Exploitation could enable client-side code execution. Affected software is the Events Calendar plugin for WordPress; vulnerable componen...
CVE-2019-11776
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context...
CVE-2019-11776
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context...
Design/Logic Flaw
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context...
CVE-2019-11776
The CVE-2019-11776 entry affects Eclipse BIRT Report Viewer (versions 1.0–4.7). The underlying issue is a reflected XSS in a URL parameter (notably the __format parameter in the Report Viewer) that allows an attacker to inject JavaScript executed in the victim’s browser context. This is caused by...
