PT-2017-3711

Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.4.0 through 5.4.5 FortiOS version 5.6.0 Description: A Cross-Site-Scripting XSS vulnerability exists in the webUI "Login Disclaimer" redir parameter, allowing a remote unauthenticated attacker to execute arbitrary javascrip...

PT-2017-7293

Name of the Vulnerable Software and Affected Versions Samsung Galaxy S6 SecEmailUI affected versions not specified Description The issue allows remote attackers to execute arbitrary JavaScript due to the lack of HTML email content sanitization. Recommendations At the moment, there is no informati...

PT-2016-3425

Name of the Vulnerable Software and Affected Versions Yandex browser for desktop versions prior to 16.6 Description The issue is related to a lack of protection for the web page structure in the BookReader extension of Yandex Browser, which could allow a remote attacker to conduct a cross-site...

CVE-2015-0821: Undefined Security Weakness

Mozilla Firefox before 36.0 allows user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions...

Ubuntu 12.04 LTS : kde-runtime vulnerability (USN-2414-1)

Tim Brown and Darron Burton discovered that KDE-Runtime incorrectly handled input validation. An attacker could possibly use this issue to execute arbitrary javascript. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory...

e107 1.0.1 - CSRF Resulting in Arbitrary Javascript Execution

No description provided by source. Exploit Title: e107 v1.0.1 Administrator CSRF Resulting in Arbitrary Javascript Execution Google Dork: intext:This site is powered by e107 Date: 01/01/13 Exploit Author: Joshua Reynolds Vendor Homepage: http://e107.org Software Link:...

Claroline 1.10 Persistent XSS Vulnerability

No description provided by source. ------------------------------------------------------------------------ Software................Claroline 1.10 Vulnerability...........Persistent Cross-site Scripting Threat Level............Moderate 2/5 Download................http://www.claroline.net/...

CVE-2013-1697: Undefined Security Weakness

The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with...

WordPress Plugin Simply Poll 1.4.1 - Multiple Vulnerabilities

Exploit Title: WordPress Simply Poll Plugin 1.4.1 CSRF and stored XSS Google Dork: inurl:"/wp-content/plugins/simply-poll Date: 16.03.2013 Exploit Author: m3tamantra Vendor Homepage: http://wordpress.org/extend/plugins/simply-poll/ Software Link:...

CVE-2013-0758: Improper Control of Generation of Code

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging...

e107 v1.0.1 CSRF Resulting in Arbitrary Javascript Execution

Exploit for php platform in category web applications Exploit Title: e107 v1.0.1 Administrator CSRF Resulting in Arbitrary Javascript Execution Google Dork: intext:"This site is powered by e107" Date: 01/01/13 Exploit Author: Joshua Reynolds Vendor Homepage: http://e107.org Software Link:...

CVE-2012-4195: Improper Neutralization of Input During Web Page Generation

The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easie...

PT-2011-4223

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6.20 SeaMonkey versions 2.x Thunderbird versions prior to 3.1.12 Description The issue arises from improper handling of dropping a tab element, allowing remote attackers to execute arbitrary JavaScript code...

Time And Expense Management System Cross Site Scripting

------------------------------------------------------------------------ Software................Time and Expense Management System Vulnerability...........Reflected Cross-site Scripting Threat Level............Low 1/5 Download................http://sourceforge.net/projects/tems/ Discovery...

OpenCollab 1.4.3 Cross Site Scripting

------------------------------------------------------------------------ Software................OpenCollab 1.4.3 Vulnerability...........Persistent Cross-site Scripting Threat Level............Moderate 2/5 Download................http://www.opencollab.de/ Vendor Contact Date.....3/10/2011...

Dokeos 1.8.6.2 Cross Site Scripting

------------------------------------------------------------------------ Software................Dokeos 1.8.6.2 Vulnerability...........Reflected Cross-site Scripting Download................http://www.dokeos.com/ Release Date............2/12/2011 Tested On...............Windows Vista + XAMPP...

Rumba CMS 2.4 Cross Site Scripting

================================== Vulnerability ID: HTB22591 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinrumbacms.html Product: Rumba CMS Vendor: Rumba Netware Ltd. http://rumbacms.com Vulnerable Version: 2.4 and Probably Prior Versions Vendor Notification: 18 August 2010...

NewsOffice 2.0.18 Cross Site Scripting

------------------------------------------------------------------------ Software................NewsOffice 2.0.18 Vulnerability...........Reflected XSS Download................http://newsoffice.newanz.com/ Release Date............7/5/2010 Tested On...............Windows Vista + XAMPP...

Fedora 12 : python-paste-1.7.4-1.fc12 (2010-10383)

1.7.4 The only real change is to paste.httpexceptions, which was using insecure quoting of some parameters and allowed an XSS hole, most specifically with its 404 messages. The most notably WSGI application using this is paste.urlparse.StaticURLParser and PkgResourcesParser. By directing someone ...

CVE-2010-0178: Improper Control of Generation of Code

Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4, does not prevent applets from interpreting mouse clicks as drag-and-drop actions, which allows remote attackers to execute arbitrary JavaScript with Chrome privileges by loading a chrome: URL an...