MyBB < 1.8.13 Multiple Vulnerabilities

MyBB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb"; ifdescription...

Moderate: Red Hat Security Advisory: python-django security update

An update for python-django is now available for Red Hat OpenStack Platform 11.0 Ocata. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

GHSA-J838-VFPQ-FMF2 actionpack Cross-site Scripting vulnerability

The sanitize helper in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : colon characters in URLs, which makes it easier for remote...

actionpack Cross-site Scripting vulnerability

The sanitize helper in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : colon characters in URLs, which makes it easier for remote...

paperclip Cross-site Scripting vulnerability

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting XSS attacks via a spoofed value, as demonstrated by image/jpeg...

CVE-2017-7089

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via a crafted web site that is mishandl...

Cross-site Scripting (XSS)

phpmyfaq is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script by uploading a HTML file to the application...

Cross-site Scripting (XSS)

mistune is vulnerable to cross-site scripting XSS attacks. These attacks can be conducted by inserting an unexpected newline or by using an email address to execute arbitrary Javascript...

Cross-Site Scripting (XSS)

silverstripe/framework is vulnerable to cross-site scripting XSS attacks. The attacker can inject arbitrary code via the rewritehashlinks parameter...

Cross-Site Scripting (XSS)

genix/cms is vulnerable to cross-site scripting XSS attacks. The vulnerability exists because userform.php is getting userID data from GET requests, allowing the attacker to inject arbitrary code into the form and launch XSS attacks...

Cross-site Scripting (XSS)

loofah is vulnerable to cross-site scripting XSS attacks. The library is does not properly sanitize nested script tags, allowing a malicious user to inject and execute arbitrary Javascript...

CVE-2017-13994

A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 linkname, 2 url, or 3 title parameter in an add action to linksmanage.php...

Cross-site Scripting (XSS)

erusev/parsedown is vulnerable to cross-site scripting XSS attacks. The library does not do any filtering or sanitization before parsing markdown, allowing a malicious user to inject and execute arbitrary web script...

Cross-Site Scripting (XSS)

genix/cms is susceptible to cross-site scripting XSS attacks. When a registered user replies to a post with an XSS payload and the administrator views this comment, the payload is executed...

Cross-Site Scripting (XSS)

anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. These attacks are possible because the comment output from commenttext is not filtered and encoded properly, allowing a malicious user to inject and execute arbitrary web script through it...

Cross site scripting

In BlackCat CMS 1.2, backend/settings/ajaxsavesettings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field...

CVE-2017-14049

In BlackCat CMS 1.2, backend/settings/ajaxsavesettings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field...

CVE-2014-9564

CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and resulting web cache poisoning or cross-site scripting XSS attack...

Cross site scripting

The Javascript method Sling.evalString in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings...