1936 matches found
Cross site scripting
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting XSS attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899...
CVE-2016-1182
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting XSS attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899...
CVE-2016-1224
CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting XSS attacks via unspecified vectors...
CVE-2016-2833
Mozilla Firefox before 47.0 ignores Content Security Policy CSP directives for cross-domain Java applets, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via a crafted applet...
TYPO3 6.2.19 / 7.6.4 RemoveXSS.php Filter Bypass
Madison Gurkha Security Advisory Advisory: TYPO3 circumvent RemoveXSS.php cross site scripting using BASE64 encoding 1. DETAILS ---------- Product: Typo3 CMS Vendor URL: typo3.org Type: Cross-site ScriptingCWE-79 Date found: 2016-03-09 Date published: 2016-05-19 2. AFFECTED VERSIONS...
CVE-2016-2817
The WebExtension sandbox feature in browser/components/extensions/ext-tabs.js in Mozilla Firefox before 46.0 does not properly restrict principal inheritance during chrome.tabs.create and chrome.tabs.update API calls, which allows remote attackers to conduct Universal XSS UXSS attacks via a craft...
MyBB < 1.8.7 Multiple Vulnerabilities
Binary data 9275.prm...
Cross site scripting
Ipswitch MOVEit File Transfer formerly DMZ 8.1 and earlier, when configured to support file view on download, allows remote authenticated users to conduct cross-site scripting XSS attacks by uploading HTML files...
CVE-2016-2512
The utils.http.issafeurl function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting XSS attacks via a URL containing basic authentication, as demonstrated by...
Fedora 23 : mediawiki-1.26.2-1.fc23 (2015-5567dd228a)
Changes since 1.26.1 bug T121892 Various special pages resulted in fatal errors. Changes since 1.26.0 bug T117899 SECURITY: $wgArticlePath can no longer be set to relative paths that do not begin with a slash. This enabled trivial XSS attacks. Configuration values such as...
How I was in the Google collaboration community GWC found the reflection type, a storage type, the DOM type of vulnerability? - Vulnerability warning-the black bar safety net
! Google for Work Connect, the GWC is a System, Application Administrator, and partner community of system, but also in Google's vulnerability reward range. Shortly before, I was in the GWC community system found reflection type, a storage type, the DOM typeXSS. The storage typeXSS In the GWC...
Mageia: Security Advisory (MGASA-2016-0051)
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2016-1900
CRLF injection vulnerability in the cgitprinthttpheaders function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting XSS attacks via newline...
CVE-2016-1900
CVE-2016-1900 affects CGit prior to 0.12. The vulnerability arises from CRLF/header injection in cgit_print_http_headers (ui-shared.c), enabling a remote attacker with write-access to a repository to inject arbitrary HTTP headers and trigger HTTP response splitting and potential XSS via newline c...
CVE-2016-1900
CRLF injection vulnerability in the cgitprinthttpheaders function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting XSS attacks via newline...
CVE-2016-0011
CVE-2016-0011 affects Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1, where remote authenticated users can bypass the Access Control Policy and perform cross-site scripting (XSS) by modifying a webpart. The root cause is a security feature bypass in SharePoint that allows...
CVE-2015-6117
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting XSS attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different...
Cross site scripting
The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and possibly obtain sensitive information or conduct cross-site scripting XSS attacks, via a crafted web site...
Cisco Unified Communications Manager Web Management Interface Cross-Site Scripting Filter Bypass Vulnerability
A cross-site scripting XSS filter bypass vulnerability in the web management interface of Cisco Unified Communications Manager UCM versions 8.0 through 8.6 could allow an unauthenticated, remote attacker to mount XSS attacks against a user of an affected device. The vulnerability is due to a...