Cross site scripting

An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formname parameter in a mod=column request, as demonstrated by the...

CVE-2019-9016

An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formname parameter in a mod=column request, as demonstrated by the...

CVE-2019-9016

CVE-2019-9016 affects MOPCMS, a PHP/MySQL-based CMS. The connected CNVD entry confirms a cross-site scripting vulnerability exists in MOPCMS up to 2018-11-30, exploitable via the form[name] parameter in a mod=column request (example URI shown). The root cause is persistent XSS allowing remote att...

Oracle Reports Developer Component Cross-site Scripting (CVE-2019-2413)

A cross-site scripting vulnerability exists in Oracle Reports component. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

CVE-2018-19782

Multiple cross-site scripting XSS vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the 1 c parameter or 2 a parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the 1 c parameter or 2 a parameter...

CVE-2018-19782

CVE-2018-19782: Multiple cross-site scripting (XSS) vulnerabilities in FreshRSS 1.11.1 affect GET requests by injecting scripts via the c parameter or the a parameter. The issue enables remote attackers to execute arbitrary web script/HTML in the context of the user session. Reported details come...

CVE-2018-20731

CVE-2018-20731 is a stored XSS vulnerability in NeDi prior to 1.7Cp3, exploitable via User-Chat.php. Public records in NVD/NVD-derived feeds describe that remote attackers can inject arbitrary web script or HTML. The connected feeds confirm NeDi versions affected up to at least 1.7Cp3 and referen...

CVE-2018-20729

A reflected cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php...

Cross-site Scripting (XSS)

mailman is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL...

Cross-site Scripting (XSS) Through Generated Pagination Links

Cross-site scripting XSS vulnerability in the willpaginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links...

Cross-site Scripting (XSS)

foreman is vulnerable to cross-site scripting. A remote authenticated attacker is able to inject arbitrary web script or HTML via the network interface device identifier in the host interface form...

Cross-site Scripting (XSS)

python-django-horizon is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the Orchestration/Stack section in OpenStack Dashboard Horizon 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the descriptio...

Same-Origin Policy Bypass

Mozilla Firefox is vulnerable to same-origin policy bypass. A flaw was discovered in Mozilla Firefox that could be used to violate the same-origin policy and inject web script into a non-privileged part of the built-in PDF file viewer PDF.js. An attacker could create a malicious web page that, wh...

Cross-site Scripting (XSS)

spacewalk-java is vulnerable to cross-site scripting XSS attacks. The vulnerability exists through multiple cross-site scripting XSS vulnerabilities in spacewalk-java in Spacewalk and Red Hat Network RHN Satellite allow remote attackers to inject arbitrary web script or HTML via unspecified vecto...

Cross-site Scripting (XSS)

cups is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as scheduler/client.c in Common Unix Printing System CUPS before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the ispathabsolute function...

Cross-site Scripting (XSS)

python-django-horizon is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the Host Aggregates interface in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via...

Multiple Cross-site Scripting (XSS) Vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in actionpack/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the 1 format, 2 negativeformat, or 3 units...

Cross-site Scripting (XSS)

openstack-swift is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header...

Remote Code Execution (RCE)

Mozilla Firefox and Thunderbird is vulnerable to remote code execution. A use-after-free vulnerability in the nsImageLoadingContent::OnStopContainer function allows a remote attacker to execute arbitrary code on a victim's system using a malicious web script. The code is executed when the victim...