PT-2018-11797

Name of the Vulnerable Software and Affected Versions Atlassian Jira versions 7.6.7 and earlier Atlassian Jira versions 7.7.0 through 7.7.4 Atlassian Jira versions 7.8.0 through 7.8.4 Atlassian Jira versions 7.9.0 through 7.9.2 Atlassian Jira versions 7.10.0 through 7.10.2 Atlassian Jira version...

Apache ActiveMQ Cross-Site Scripting Vulnerability (CNVD-2018-16203)

Apache ActiveMQ is an open source message broker that can be used as an intermediary to communicate data between other software. A cross-site scripting vulnerability exists in Apache ActiveMQ, which can be exploited by remote attackers to inject arbitrary web script or HTML...

CVE-2018-13392

Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in linked issue keys...

PT-2018-11794

Name of the Vulnerable Software and Affected Versions Atlassian Fisheye and Crucible versions prior to 4.6.0 Description The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in linked issue keys. Recommendations For versions prior t...

CVE-2018-6681

Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management NSM 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface...

Cross site scripting

The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of user submitted add-on names...

Cross site scripting

The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML ...

CVE-2018-5229: Improper Neutralization of Input During Web Page Generation

The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of user submitted add-on names...

WordPress Product Enquiry for WooCommerce Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Product Enquiry for WooCommerce plugin, which can be exploited b...

Code injection

Code Injection vulnerability in the ePolicy Orchestrator ePO extension in McAfee Threat Intelligence Exchange TIE Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector...

PT-2018-7283

Name of the Vulnerable Software and Affected Versions: McAfee Threat Intelligence Exchange TIE Server versions 2.1.0 and earlier Description: A Code Injection issue in the ePolicy Orchestrator ePO extension allows remote attackers to execute arbitrary HTML code, which is then reflected in the...

CVE-2017-3907: Improper Control of Generation of Code

Code Injection vulnerability in the ePolicy Orchestrator ePO extension in McAfee Threat Intelligence Exchange TIE Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector...

Symphony CMS <= 2.7.6 XSS Vulnerability

Symphony CMS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2018-11552

There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON-Auto-Dialer-Agents-Name" field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable applicati...

Cross-site Scripting (XSS)

cucumber is vulnerable to cross-site scripting XSS attacks. The HTML formatter appends any scenario output without sanitization, allowing a malicious user to inject and execute arbitrary HTML code...

CVE-2017-3961

Cross-Site Scripting XSS vulnerability in the web interface in McAfee Network Security Management NSM before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes...

CVE-2018-0576: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-10371

An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser via a pag...

WordPress Catapult UK Cookie Consent Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports the setting up of personal blog sites on servers with PHP and MySQL.Catapult UK Cookie Consent is a plugin used to add a cached notification bar to a website. A cross-site...

CVE-2018-10310: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary HTML/script code in the context of a victim's browser...