CVE-2016-3015

IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference : 1998887...

IBM Cognos Analytics Cross-Site Scripting Vulnerability

IBM Cognos Analytics formerly known as Cognos BI is a suite of business intelligence software from the American company IBM. The software includes reports, dashboards and scorecards, and can assist companies in adjusting their decisions by analyzing key factors and key stakeholders. A cross-site...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2017-04814)

IBM Rational Quality Manager is a collaborative, Web-based quality management solution. A cross-site scripting vulnerability exists in IBM Rational Quality Manager, which allows an attacker to embed arbitrary JavaScript code into the Web UI, which could change the intended use and result in the...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2017-04813)

IBM Rational Quality Manager is a collaborative, Web-based quality management solution. A cross-site scripting vulnerability exists in IBM Rational Quality Manager, which allows an attacker to embed arbitrary JavaScript code into the Web UI, which could change the intended use and result in the...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2017-04812)

IBM Rational Quality Manager is a collaborative, Web-based quality management solution. A cross-site scripting vulnerability exists in IBM Rational Quality Manager, which allows an attacker to embed arbitrary JavaScript code into the Web UI, which could change the intended use and result in the...

CVE-2014-9691

Huawei Tecal vulnerabilities CVE-2014-9691 affect multiple Tecal server models (e.g., RH1288 V2, RH2265 V2, RH2288 V2, RH5885 etc.) and variants listed in the Huawei advisory. The issue is an information disclosure via the web UI Online Users page, allowing logged-in users’ session IDs to be view...

CVE-2017-2453

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof FaceTime prompts in the user interface via a crafted web site...

CVE-2016-6036

IBM Rational Quality Manager RQM 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Referenc...

CVE-2016-9990

IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference : 1998824...

CVE-2016-7542

A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators password hashes not including super-admins stored on the appliance via the webui REST API, and may therefore be able to crack them...

CVE-2016-7542

A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators password hashes not including super-admins stored on the appliance via the webui REST API, and may therefore be able to crack them...

Concepts, Entities and Terms used for nFactor Authentication through NetScaler

nFactor is the new authentication framework that allows an administrator to configure complex authentication scenarios fairly easily. It reduces complexity through flexible and extensible authentication mechanisms. This framework could be used to configure all the authentication modes currently...

Cisco IOS XE Web User Interface DoS (cisco-sa-20170322-webui)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the web user interface due to insufficient resource handling. An unauthenticated, remote attacker can exploit this issue, by sending a high number of...

Cross site scripting

Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted non-admin account. The website name wasn't properly escaped when displayed in the campaign-zone.php script...

Cross site scripting

Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted non-admin account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages...

Cross site request forgery (csrf)

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery CSRF. A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: www/admin/banner-acl.php, www/admin/banner-activate.php, www/admin/banner-advanced.php, www/admin/banner-modify.php,...

CVE-2016-9454

Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted non-admin account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages...

CVE-2016-9454

Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted non-admin account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages...

CVE-2016-9130

Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted non-admin account. The website name wasn't properly escaped when displayed in the campaign-zone.php script...

CVE-2016-9454

Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted non-admin account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages...