CVE-2017-16544

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...

CVE-2017-16544

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...

GHSA-QQXP-XP9V-VVX6 jquery-ui Tooltip widget vulnerable to XSS

Cross-site scripting XSS vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo...

jquery-ui Tooltip widget vulnerable to XSS

Cross-site scripting XSS vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo...

Moderate severity vulnerability that affects jquery-ui

Cross-site scripting XSS vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo...

Legal Robot: Autocomplete feature

A security researcher discovered that several password fields did not contain the Autocomplete attribute. Thanks to @gujjuboy10x00 for pointing this out!...

Bypass Access Restrictions

Moodle is vulnerable to bypassing of access restrictions. The bypass is possible because tag/tagautocomplete.php ignores the moodle/tag:edit capability before adding a tag, allowing any authenticated users to launch attack through an AJAX request...

versandapotheke-allgaeu.de XSS vulnerability

Vulnerable URL: http://www.versandapotheke-allgaeu.de/autocomplete.php/?fallbackurl=http://www.versandapotheke-allgaeu.de/catalogsearch/ajax/suggest/=default=test"'--! Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability...

Linkit - Moderately Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-033

Linkit provides an easy interface for internal and external linking with WYSIWYG editors by using an autocomplete field. When searching for entities, this module doesn't always enforce the access restrictions and users may see information about entities they should not be able to access. This is...

CVE-2017-5866

The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2017-5866

The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2017-5866

The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2017-2609

jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions SECURITY-385. The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which the current user does not have access to...

Information disclosure in email field dialog at sharing - ownCloud

An attacker can get sensitive information in the E-Mail share dialog with the autocompletion by default Affected Software ownCloud Server 9.1.3 CVE-2017-5866 core/c27b2b935f940a2c8e2fc1a5d8934407ae85dd57 ownCloud Server 9.0.7 CVE-2017-5866 core/62b1865a301a1ce90f9a3c773f5eb00c33deb581 ownCloud...

Drupal Autocomplete Deluxe Module Cross-Site Scripting Vulnerability

Drupal is the Drupal community maintained by a set of free , open source content management system developed in PHP language . Autocomplete Deluxe is one of the modules based on the JQuery UI autocomplete for the classification field to create a new widget . A cross-site scripting vulnerability...

Autocomplete Deluxe - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-003

This module creates a new widget for taxonomy fields based on JQuery UI autocomplete. The module doesn't sufficiently escape the entered taxonomy terms thereby exposing a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have the permission ...

auto.etnet.com.hk XSS vulnerability

Vulnerable URL: http://auto.etnet.com.hk/AutoComplete/AutoComplete?lang=TC=prompt/OPENBUGBOUNTY/...

Drupal Fast Autocomplete Module Remote Denial of Service Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Fast Autocomplete is one of the modules used to quickly create configurable view patterns. A remote denial of service vulnerability exists in version 7.x-1.x of the Drupal Fast...

Uber: Cross-site Scripting (XSS) autocomplete generation in https://www.uber.com/

Description: The website located at https://www.uber.com/ suffers from a generated Cross-site Scripting XSS vulnerability in the "find a city" input field. Reproduction Steps: Open the latest Chrome web browser Navigate to the following URL's "find a city input field": https://www.uber.com/ Type ...

Fast Autocomplete - Critical - DOS vulnerability - SA-CONTRIB-2016-016

This module enables you to show IMDB-like suggestions when entering terms into an input field using json files to "cache" suggestions making the autocomplete very fast. The module doesn't sufficiently validate the incoming language parameter in the request path when a json file of the module is...