Cross site scripting

Cross-site scripting XSS vulnerability in synnefoclient in Synnefo Internet Management Software IMS 2015 allows remote attackers to inject arbitrary web script or HTML via the planname parameter to packagehistory/listusagesdata...

OSSEC Web UI 'searchid' Parameter Cross Site Scripting Vulnerability

OSSEC Web UI is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Microsoft Internet Explorer XSS Filter CVE-2015-6138 Security Bypass Vulnerability

Description Microsoft Internet Explorer is prone to a security-bypass vulnerability that affects the XSS Filter. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. They can then execute arbitrary script code in the context of th...

Microsoft Edge XSS Filter CVE-2015-6176 Security Bypass Vulnerability

Description Microsoft Edge is prone to a security-bypass vulnerability that affects the XSS Filter. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. An attacker can exploit this issue to execute arbitrary script code in the...

Microsoft Internet Explorer XSS Filter CVE-2015-6144 Security Bypass Vulnerability

Description Microsoft Internet Explorer is prone to a security-bypass vulnerability that affects the XSS Filter. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. An attacker can exploit this issue to execute arbitrary script...

JVN#70083512: Web Analytics Service vulnerable to cross-site scripting

The JavaScript module for using Web Analytics Service which was provided by NTT DATA Smart Sourcing Corporation contains a cross-site scripting vulnerability CWE-79 due to a flaw in escaping process. According to the developer, this script was distributed from 26 November, 2003 to 9 July, 2013...

VLC Media Player Web Interface Cross Site Scripting Vulnerability (Dec 2015) - Windows

VLC media player is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

JVN#35845584: Frame high-speed chat vulnerable to cross-site scripting

Frame high-speed chat provided by Let's PHP! contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Apply an Update Update to the latest version according to the information provided by the developer. Products Affected...

OcProducts OcPortal 'FIELD_NAME' Parameter Cross-Site Scripting Vulnerability

OcProducts ocPortal is an open source PHP and MySQL based Content Management System CMS from OcProducts. A cross-site scripting vulnerability exists in OcProducts OcPortal. An attacker can exploit this vulnerability to execute arbitrary script code, steal cookie-based authentication and launch...

Void vulnerable to cross-site scripting

Overview Void is an open source content management system CMS. Void contains a cross-site scripting vulnerability CWE-79. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA under Information Security Early Warning Partnership. Impact An arbitrary script may be...

Magento HTML Injection Vulnerability

Magento is a professional open source PHP e-commerce system from Magento, USA, which provides permission management, search engine and payment gateway. Magento has an HTML injection vulnerability. A remote attacker can exploit the vulnerability to execute arbitrary script or HTML code in the...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2015-07734)

Adobe ColdFusion is a dynamic Web server , its CFML is a programming language , similar to the current JSP in the JSTL. A cross-site scripting vulnerability exists in Adobe ColdFusion. The program fails to adequately filter user-supplied input, allowing remote attackers to execute arbitrary scrip...

applican vulnerable to script injection

Overview applican provided by Newphoria Corporation Inc. is a platform to build hybrid applications for both iOS and Android. applican is vulnerable to script injection due to an issue in proccessing URL. Note that this vulnerability is different from JVN71088919. Kenta Suefusa and Tomonori Shiom...

TYPO3 News system extension cross-site scripting vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the TYPO3 Association in Switzerland. news system news is one of the extension components that provides press release functionality. A cross-site scripting vulnerability exists in TYPO3 News system extension...

Mozilla Firefox Multiple Vulnerabilities (Nov 2015) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Komento Component HTML Injection Vulnerability in Joomla!

Joomla! is an open source content management system CMS developed by the Open Source Matters team in the U.S. Komento is one of the generic commenting components. An HTML injection vulnerability exists in Joomla! Komento component versions prior to 2.0.5. An attacker can exploit this vulnerabilit...

Samsung SecEmailUI - Script Injection

Source: https://code.google.com/p/google-security-research/issues/detail?id=494 ''' The default Samsung email client's email viewer and composer implemented in SecEmailUI.apk doesn't sanitize HTML email content for scripts before rendering the data inside a WebView. This allows an attacker to...

DNN (DotNetNuke) < 7.4.2 Multiple Vulnerabilities

The version of DNN installed on the remote host is affected by multiple vulnerabilities : - An unspecified cross-site scripting vulnerability exists due to a failure to properly sanitize content used by the tabs control. An unauthenticated, remote attacker can exploit this to execute arbitrary...

Joomla CMS 'login' Module XSS Vulnerability

Joomla is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...

Dojo Toolkit Cross-Site Scripting Vulnerability

Dojo Toolkit is the Dojo Foundation a JavaScript language implementation of open source DHTML toolkit . A cross-site scripting vulnerability exists in versions of Dojo Toolkit prior to 1.2. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML...