PT-2015-6205

Name of the Vulnerable Software and Affected Versions Drupal Taxonomy Path module versions prior to 7.x-1.2 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML. This is achieved via the "Link to path" field formatter...

Cross site scripting

Cross-site scripting XSS vulnerability in the login page in Cisco TC Software before 7.1.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq94977...

CVE-2015-0345: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-4574

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 10 before Update 16 Adobe ColdFusion versions 11 before Update 5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For...

CVE-2015-2781

CVE-2015-2781 describes a cross-site scripting (XSS) vulnerability in Hotspot Express hotEx Billing Manager 73, via the hotspotlogin.cgi parameter reply. A malicious user can inject script into pages viewed by other users; PoC shows script execution (e.g., alert(document.cookie)). The vulnerable ...

PT-2015-5411

Name of the Vulnerable Software and Affected Versions Microsoft Project Server versions 2010 SP2 through 2013 SP1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted request. This affects Microsoft SharePoint. Recommendations F...

Input validation

Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI...

CVE-2015-2932

Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element...

CVE-2015-2934

MediaWiki vulnerability CVE-2015-2934 affects MediaWiki versions before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2. The issue arises from the Zend xml_parse function not expanding entities, enabling remote attackers to inject arbitrary web script or HTML via a crafted SVG file. Impact ...

CVE-2015-2934

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xmlparse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file...

CVE-2015-3005: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Dynamic VPN in Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, and 12.3X48 before 12.3X48-D10 on SRX series devices allows remote attackers to inject arbitrary web script or HTML via unspecified vector...

PT-2015-5982

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.24 MediaWiki versions 1.20.x through 1.23.9 MediaWiki versions 1.24.x through 1.24.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element...

CVE-2015-1773

CVE-2015-1773 affects the Apache Flex ASDoc tool. The vulnerability exists in the output HTML generated by asdoc/templates/index.html, where a crafted URI can cause JavaScript code generated by the asdoc component to execute, yielding a reflected XSS. Affected versions are Apache Flex before 4.14...

CVE-2015-2827: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in CA Spectrum 9.2.x and 9.3.x before 9.3 H02 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-0876

Multiple cross-site scripting XSS vulnerabilities in the printlanguageselectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-0876

CVE-2015-0876 affects Saurus CMS Community Edition, specifically the print_language_selectbox function in files like classes/adminpage.inc.php. The vulnerability is cross-site scripting (XSS) that could allow an attacker to inject arbitrary script or HTML into a user’s browser. Impact is browser-...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Report Viewer in Ericsson Drutt Mobile Service Delivery Platform MSDP 4.x, 5.x, and 6.x allow remote attackers to inject arbitrary web script or HTML via the 1 portal, 2 fromDate, 3 toDate, 4 fromTime, 5 toTime, 6 kword, 7 uname, 8 pname, 9...

CVE-2015-2165: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Report Viewer in Ericsson Drutt Mobile Service Delivery Platform MSDP 4.x, 5.x, and 6.x allow remote attackers to inject arbitrary web script or HTML via the 1 portal, 2 fromDate, 3 toDate, 4 fromTime, 5 toTime, 6 kword, 7 uname, 8 pname, 9...

Cross site scripting

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

WordPress Navis DocumentCloud Plugin <= 0.1.0 - XSS

This vulnerability is in js/window.php. It allows an attacker to inject arbitrary web script or HTML via the "wpbase" parameter. Solution Update the plugin...