CVE-2017-12097: Improper Neutralization of Input During Web Page Generation

An exploitable cross site scripting XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an...

Ruby on Rails gem version 1.4 delayed_job_web XSS Vulnerability

Exploit for ruby platform in category web applications Summary An exploitable XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the...

IBM QRadar Cross-Site Scripting Vulnerability (CNVD-2018-01026)

IBM QRadar is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. A cross-site scripting...

CVE-2017-16864: Improper Neutralization of Input During Web Page Generation

The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the orderby parameter...

Cross-site Scripting (XSS)

Apache Sling XSS is vulnerable to cross-site scripting XSS attacks. The application does not properly encode or escape URLs, allowing a malicious user to inject and execute arbitrary Javascript...

PT-2018-6510

Name of the Vulnerable Software and Affected Versions: IBM Curam Social Program Management versions 6.0.5, 6.1.1, 6.2.0, 7.0.1, 7.0.2 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

rails_admin rails gem XSS vulnerability

Summary An exploitable XSS vulnerability exists in the add filter functionality of the railsadmin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim’s browser. An attacker can phish an...

PT-2018-5792

Name of the Vulnerable Software and Affected Versions: IBM Security Access Manager Appliance version 9.0.3 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

Cross-site Scripting (XSS)

marked is vulnerable to cross-site scripting XSS attacks. The library does not properly escape URLs when mangling is disabled, allowing a malicious user to inject and execute arbitrary Javascript...

Cross-site Scripting (XSS)

radiant-markdownfilter-extension is vulnerable to cross-site scripting XSS attacks. The application does not properly escape html elements before rendering them, allowing a malicious user to inject and execute arbitrary Javascript...

PT-2018-6316

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Key Lifecycle Manager versions 2.5 through 2.7 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

PT-2018-5243

Name of the Vulnerable Software and Affected Versions ELabftw version 1.7.8 Description The issue concerns stored cross-site scripting in the experiment infos component, which can lead to the arbitrary execution of JavaScript and denial of service. Recommendations For ELabftw version 1.7.8, updat...

CVE-2018-3810: Improper Authentication

Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code via the sgcgoogleanalytic parameter that runs on all pages served by WordPress. The saveGoogleCode function in...

PT-2018-16206

Name of the Vulnerable Software and Affected Versions Oturia Smart Google Code Inserter plugin versions prior to 3.5 Description The issue allows unauthenticated attackers to insert arbitrary JavaScript or HTML code that runs on all pages served by WordPress. This is achieved via the...

CVE-2017-17792

Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...

Cross site scripting

Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...

CVE-2017-17792

Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...

PT-2017-14352

Name of the Vulnerable Software and Affected Versions IBM Security Guardium version 10.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session...

PT-2017-3777

Name of the Vulnerable Software and Affected Versions SAP Fiori Client versions prior to 1.11.5 Description The issue is related to insufficient access control in the SAP Fiori Client mobile environment, allowing a remote attacker to gain unauthorized access to protected information and execute...

CVE-2017-1549

IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131289...