2506 matches found
Microsoft SharePoint Server CVE-2019-0963 Cross Site Scripting Vulnerability
Description Microsoft SharePoint Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...
CVE-2018-18286: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the changepwd interface. A successful exploit could allow an attacker to extract sensitive information from the...
CVE-2018-19275: Initialization of a Resource with an Insecure Default
The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain unauthorized access and execute arbitrary scripts with potential impacts to the confidentiality, integrity and availability of the system...
PT-2019-7836
Name of the Vulnerable Software and Affected Versions Moxa G3100V2 Series versions prior to 2.8 Moxa OnCell G3111/G3151/G3211/G3251 Series versions prior to 1.7 Description The issue allows a reflected cross-site scripting attack, which may enable an attacker to execute arbitrary script code in t...
CloudBees Jenkins Script Security Plugin Sandbox Bypass Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A sandbox bypass vulnerabilit...
PT-2019-16778
Name of the Vulnerable Software and Affected Versions Nessus versions 8.2.1 and earlier Description The issue is due to improper validation of user-supplied input, leading to a stored XSS vulnerability. An authenticated, remote attacker could exploit this via a specially crafted request to execut...
CVE-2018-0665
CVE-2018-0665 affects Yamaha routers RT57i (≤8.00.95), RT58i (≤9.01.51), NVR500 (≤11.00.36), and RTX810 (≤11.01.31). The vulnerability allows an administrative user to embed arbitrary scripts into a configuration form field, which may be executed in another administrative user’s web browser. This...
PT-2019-1390
Name of the Vulnerable Software and Affected Versions Cisco Jabber Client Framework affected versions not specified Description A vulnerability exists due to insufficient validation of user-supplied input, allowing an authenticated, remote attacker to conduct a cross-site scripting XSS attack. Th...
CVE-2018-1000856
DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting XSS vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear t...
CVE-2018-1000856
DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting XSS vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear t...
PT-2018-9580
Name of the Vulnerable Software and Affected Versions DomainMOD versions 4.09.03 through 4.11.01 Description The issue concerns a Cross Site Scripting XSS vulnerability in the Segment Name field on the segments page. This can lead to the execution of arbitrary scripts on the browsers of all users...
JVN#32155106: Multiple vulnerabilities in i-FILTER
i-FILTER provided by Digital Arts Inc. contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2018-16180 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:M/Au:N/C:N/I:P/A:N| Base Score: 4.3 HTTP...
PT-2018-1831
Name of the Vulnerable Software and Affected Versions: Cisco Prime Service Catalog affected versions not specified Description: The issue is related to insufficient protection of the web page structure, allowing for cross-site scripting XSS attacks. An attacker could exploit this by persuading a...
WordPress Plugin Event Calendar WD Cross-Site Scripting Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Event Calendar WD, which could allow an attacker to execu...
Security update for libgit2 (moderate)
This update for libgit2 fixes the following issues: - CVE-2018-8099: Fixed possible denial of service attack via different vectors by not being able to differentiate between these status codes bsc1085256. - CVE-2018-11235: With a crafted .gitmodules file, a malicious project can execute an...
SUSE-SU-2018:3440-1 Security update for libgit2
This update for libgit2 fixes the following issues: - CVE-2018-8099: Fixed possible denial of service attack via different vectors by not being able to differentiate between these status codes bsc1085256. - CVE-2018-11235: With a crafted .gitmodules file, a malicious project can execute an...
PT-2018-3753
Name of the Vulnerable Software and Affected Versions Mitel ST 14.2 versions GA29 19.49.9400.0 and earlier Description The issue is related to insufficient validation for the "signin.php" page, which could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack. A...
Cisco Wireless LAN Controller Software Cross-Site Scripting Vulnerability
Cisco Wireless LAN Controller WLC is a wireless LAN controller product from Cisco USA. The product provides security policy, intrusion detection and other functions in the wireless LAN. A cross-site scripting vulnerability exists in Cisco Wireless LAN Controller Software due to a web-based...
Wordpress plugin Wordfence 503.php page cross-site scripting vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Wordpress plugin Wordfence 503.php page, which can be exploited by an...