672 matches found
Design/Logic Flaw
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload...
CVE-2019-18873: Improper Neutralization of Special Elements used in an OS Command
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload...
CVE-2019-17488
b3log Symphony aka Sym before 3.6.0 has XSS via the HTTP User-Agent header...
CVE-2019-17488
b3log Symphony aka Sym before 3.6.0 has XSS via the HTTP User-Agent header...
CVE-2019-17488
b3log Symphony aka Sym before 3.6.0 has XSS via the HTTP User-Agent header...
PT-2019-15163
Name of the Vulnerable Software and Affected Versions b3log Symphony aka Sym versions prior to 3.6.0 Description The issue allows for XSS via the HTTP User-Agent header. Recommendations For versions prior to 3.6.0, update to version 3.6.0 or later to resolve the issue...
CVE-2019-17488: Improper Neutralization of Input During Web Page Generation
b3log Symphony aka Sym before 3.6.0 has XSS via the HTTP User-Agent header...
CVE-2015-9430
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header...
CVE-2015-9430: Improper Neutralization of Input During Web Page Generation
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header...
CVE-2016-10964
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header...
CVE-2016-10964
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header...
UBUNTU-CVE-2019-16197
In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS...
CVE-2016-10964
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header...
PT-2019-14573 · Dolibarr · Dolibarr
Name of the Vulnerable Software and Affected Versions: Dolibarr version 10.0.1 Description: The issue concerns the copying of the User-Agent HTTP header value into an HTML document as plain text between tags, leading to a potential XSS issue. Recommendations: For Dolibarr version 10.0.1, consider...
CVE-2014-10394
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...
Code injection
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...
CVE-2014-10394
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...
CVE-2014-10394
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...
CVE-2014-10394
The CVE-2014-10394 entry affects the WordPress Rich Counter plugin prior to version 1.2.0. The vulnerability is a JavaScript injection resulting from a crafted User-Agent header, as documented across multiple sources (NVD entry and vendor/Red Hat references). The practical impact is an injection ...
CVE-2014-10394: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header...