Wordpress simplified-content plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers. simplified-content is one of the plug-ins used to simplify the content. A cross-site scripting vulnerability exists in...

Trello: Can run arbitrary script on em.trello.com

It was possible to cause arbitrary content and script to be served on em.trello.com. While this didn't directly compromise user data, this behavior could be used as part of a phishing attack. While em.trello.com is not normally in scope for our bug bounty program, this issue was severe enough tha...

SetucoCMS Cross-Site Scripting Vulnerability

SetucoCMS is a content management system CMS. A cross-site scripting vulnerability exists in SetucoCMS. An attacker can exploit this vulnerability to execute arbitrary script on a user's web browser...

"Schedule" function in Cybozu Office vulnerable to cross-site scripting

Overview Cybozu Office provided by Cybozu,Inc. contains a cross-site scripting vulnerability. Kusano Kazuhiko reported this vulnerability to Cybozu, Inc., and Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated...

BaserCMS cross-site scripting vulnerability (CNVD-2016-08858)

baserCMS is an enterprise-level content management system CMS. A cross-site scripting vulnerability exists in baserCMS 3.0.10 and prior versions, which stems from the program failing to adequately filter user-submitted input. The vulnerability allows an attacker to steal cookie-based authenticati...

JVN#92765814: Multiple vulnerabilities in baserCMS

baserCMS provided by baserCMS User Group is an opensource content management system. baserCMS and bundled plugins "Blog", "Mail", "Feed", and "Uploader" contain the following vulnerabilities. Cross-site request forgery CWE-352 - CVE-2016-4879, CVE-2016-4881, CVE-2016-4884, CVE-2016-4885,...

Drupal Core Cross-Site Scripting Vulnerability (CNVD-2016-08263)

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Core that allows an attacker to steal cookie-based authentication credentials, obtain sensitive information, and execute arbitrary script code in the context of the...

CVE-2016-4058

Cross-site scripting XSS vulnerability in Huawei Policy Center before V100R003C10SPC020 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to "special characters on pages."...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.51089.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.52249.0.2A F...

File Upload Vulnerability in UFIDA Financials

UFIDA Financials is a financial management software. A file upload vulnerability exists in UFIDA Financial System. Vulnerability payload: http://target/TaskManager/EBankTaskServlet?m=1&taskjson=cnvdtest&taskname=... /... /R9iPortal/upload/cnvd.jsp%00&optionType=create Submitting the above request...

Splunk Enterprise and Splunk Light vulnerable to cross-site scripting

Overview Splunk Enterprise and Splunk Light contain a cross-site scripting vulnerability CWE-79. Note that this vulnerability is different from JVN71462075. Noriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

PRTG Network Monitor XSS Vulnerability

PRTG Network Monitor is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Exchange Server CVE-2016-3379 Cross Site Scripting Vulnerability

Description Microsoft Exchange Server is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow...

BigTree-CMS 4.1.x < 4.1.9 XSS

Binary data 9553.prm...

ClipBucket < 2.8.1 XSS Vulnerability

ClipBucket is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. SPDX-FileCopyrightText: 2016 Greenbone ...

Google Chrome Cross-Site Scripting Vulnerability (CNVD-2016-07212)

Google Chrome is a web browser developed by the American company Google Google. A cross-site scripting vulnerability exists in versions of Google Chrome prior to 53.0.2785.89. An attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2016-2995

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2997, CVE-2016-300...

Foxit Reader and PhantomPDF Remote Command Execution Vulnerability

Foxit Reader is China's Foxit Foxit Software Corporation produced a small PDF document viewing and printing program, PhantomPDF is a commercial version. A remote command execution vulnerability exists in Foxit Reader and PhantomPDF that could be exploited to allow an attacker to execute arbitrary...

Foxit Reader and Foxit PhantomPDF Out-of-Bounds Read/Write Remote Command Execution Vulnerability

Foxit Reader is China's Foxit Foxit Software Corporation produced a small PDF document viewing and printing program, PhantomPDF is a commercial version. Foxit Reader and Foxit PhantomPDF have an out-of-bounds read/write remote command execution vulnerability that could be exploited by an attacker...