Rockwellautomation Controllogix Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple cross-site scripting XSS vulnerabilities in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. File data ot500258.nasl...

Rockwellautomation Powermonitor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a targeted userâ??s web browser to gain access to the affected device. File data ot500118.nasl...

Siemens Simatic Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting XSS vulnerability in the web server on Siemens SIMATIC S7-1200 PLCs 2.x through 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI. File data ot500100.nasl...

CVE-2019-11656

Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. This vulnerability could allow Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross site scripting

An Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI...

CVE-2019-3591

McAfee DLPe (Data Loss Prevention Endpoint) with the ePO extension for Windows has a stored XSS vulnerability (CVE-2019-3591) due to improper input neutralization during web page generation in the ePO UI. A remote, unauthenticated user can trigger JavaScript via a crafted upload to a remote websi...

CVE-2019-3591 DLP Endpoint ePO extension vulnerable to XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in ePO extension in McAfee Data Loss Prevention DLPe for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted uploa...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Premium Software CLEdit The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a link A element...

UBUNTU-CVE-2019-1010091

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab...

CVE-2019-1010091

Removed by vendor...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

Siemens CP 1604 and 1616 <= v2.8 Improper Neutralization of Input during Web Page Generation

Binary data 720258.prm...

Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation

In Materialize through 1.0.0, XSS is possible via the Toast feature...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

In Bootstrap, XSS is possible in the tooltip or popover data-template attribute...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

In Bootstrap, XSS is possible in the affix configuration target property...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

In Bootstrap, XSS is possible in the tooltip data-viewport attribute...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

In Bootstrap, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041...

CVE-2018-7810

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browse...

CVE-2018-7810

CVE-2018-7810 is an XSS vulnerability in the embedded web servers of Schneider Electric Modicon M340, Premium, Quantum PLCs and BMXNOR0200. The root cause is improper neutralization of input during web page generation, allowing an attacker to craft a URL containing JavaScript that will be execute...

CVE-2018-7355

All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. Due to improper neutralization of input during web page generation, an attacker could exploit this vulnerability to conduct reflected XSS or HTML injection...