PT-2017-3777

Name of the Vulnerable Software and Affected Versions SAP Fiori Client versions prior to 1.11.5 Description The issue is related to insufficient access control in the SAP Fiori Client mobile environment, allowing a remote attacker to gain unauthorized access to protected information and execute...

Cross site scripting

A Cross-Site-Scripting XSS vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary javascript code via webUI "Login Disclaimer" redir parameter...

CVE-2017-7733

A Cross-Site-Scripting XSS vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary javascript code via webUI "Login Disclaimer" redir parameter...

CVE-2016-6800

CVE-2016-6800 affects the Apache OFBiz blog feature: unsanitized input in the summary/article fields allows injection of arbitrary JavaScript, which is executed in users’ browsers visiting the article. Mitigation is to upgrade to Apache OFBiz 16.11.01. This vulnerability detail is supported by th...

Cross site scripting

IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Cross site scripting

An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled...

CVE-2017-12062

An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled...

CVE-2017-12062

An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled...

PT-2017-12328

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.5.2 Description A security issue was found that allows remote attackers to execute arbitrary JavaScript code. This occurs because the filter field in the manage user page.php file is not properly sanitized before...

PT-2017-12325

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager for Lifecycle/Power/Patch Platform and Applications affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and...

PT-2017-18830

Name of the Vulnerable Software and Affected Versions Hitachi Device Manager versions prior to 8.5.2-01 Hitachi Replication Manager versions prior to 8.5.2-00 Description A cross-site scripting issue allows authenticated remote users to execute arbitrary JavaScript code. Recommendations For Hitac...

Cross site scripting

IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125732...

PT-2017-12710

Name of the Vulnerable Software and Affected Versions IBM Content Navigator & CMIS versions 2.0 through 3.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

Stored Cross-Site Scripting (XSS)

Apache Ranger is vulnerable to stored cross-site scripting XSS attacks. When entering custom policy conditions, admin users can store some arbitrary javascript code to be executed when normal users login and access policies...

PT-2017-17147

Name of the Vulnerable Software and Affected Versions ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers versions...

CVE-2016-8506: Improper Neutralization of Input During Web Page Generation

XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code...

CVE-2016-8505: Improper Neutralization of Input During Web Page Generation

XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code...

PT-2016-3427

Name of the Vulnerable Software and Affected Versions Yandex browser for desktop versions 15.12 through 16.2 Description The issue is related to a lack of protection for the web page structure in the Yandex Browser Translator extension, allowing a remote attacker to conduct a cross-site scripting...

Pootle Server < 2.7.3 Multiple XSS Vulnerabilities

Pootle server is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

PYSEC-2015-25

The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types...