CVE-2018-20676: Improper Neutralization of Input During Web Page Generation

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute...

CVE-2018-20677: Improper Neutralization of Input During Web Page Generation

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property...

PT-2019-20559

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property...

PT-2019-20557

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property...

PT-2019-20561

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property...

PT-2019-5359

Name of the Vulnerable Software and Affected Versions Bootstrap versions prior to 3.4.0 Description The issue is related to the affix plugin in Bootstrap, which does not properly protect the structure of a web page, allowing for potential exploitation. This could enable a remote attacker to perfo...

PT-2019-5358

Name of the Vulnerable Software and Affected Versions Bootstrap versions prior to 3.4.0 Description The issue is related to the tooltip component of the Bootstrap toolkit, which fails to properly protect the structure of web pages. This can be exploited by a remote attacker to perform cross-site...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

In Bootstrap, XSS is possible in the tooltip data-viewport attribute...

PT-2019-7534

Name of the Vulnerable Software and Affected Versions Bootstrap versions 2.0.4 through 3.x before 3.4.0 Bootstrap versions 4.x-beta before 4.0.0-beta.2 Description XSS is possible in the data-target attribute. This issue is different from other known vulnerabilities. Recommendations For Bootstrap...

CVE-2016-10735: Improper Neutralization of Input During Web Page Generation

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041...

Security fix for the ALT Linux 9 package krb5 version 1.16.3-alt1

Jan. 8, 2019 Ivan A. Melnikov 1.16.3-alt1 - 1.16.3 CVE-2018-20217 - apply bootstrap and e2k tweaks mike@ closes: 32982 + introduce doc, ldap, selinux, verto knobs on by default + conditionally package bundled libverto + e2k: disable -Werror=pointer-arith,uninitialized lcc...

DRUPAL-CONTRIB-2018-074

This base theme bridges the gap between Drupal and the Bootstrap Framework. The theme doesn't sufficiently filter valid targets under the scenario of opening modals, popovers, and tooltips. This vulnerability is mitigated by the fact that an attacker must already have the ability to either: 1...

Mac OS X libxpc MITM Privilege Escalation Exploit

This Metasploit module exploits a vulnerability in libxpc on macOS versions 10.13.3 and below. The tasksetspecialport API allows callers to overwrite their bootstrap port, which is used to communicate with launchd. This port is inherited across forks: child processes will use the same bootstrap...

PT-2018-19495

This base theme bridges the gap between Drupal and the Bootstrap Framework. The theme doesn't sufficiently filter valid targets under the scenario of opening modals, popovers, and tooltips. This vulnerability is mitigated by the fact that an attacker must already have the ability to either: 1...

Bootstrap - Moderately critical - Cross site scripting - SA-CONTRIB-2018-074

This base theme bridges the gap between Drupal and the Bootstrap Framework. The theme doesn't sufficiently filter valid targets under the scenario of opening modals, popovers, and tooltips. This vulnerability is mitigated by the fact that an attacker must already have the ability to either:...

Cross-site Scripting (XSS)

bootstrap-datepicker is vulnerable to a cross-site scripting XSS attack. The library does not properly handle the jQuery for the date container, allowing a malicious user to inject arbitrary Javascript...

Bootstrap < 2.1.0 Cross-Site Scripting

According to its self-reported version number, Bootstrap is prior to 2.1.0. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via html option for popovers/tooltips which is unescaped when grabbed with jQuery's .attr method. Note that the scanner has not tested for these...

Bootstrap < 3.4.0 Cross-Site Scripting

According to its self-reported version number, Bootstrap is prior to 3.4.0. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via the data-target attribute. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported...

Bootstrap 4.0.0 < 4.1.2 Cross-Site Scripting

According to its self-reported version number, Bootstrap is at least 4.0.0 and prior to 4.1.2. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via the tooltip, collapse and scrollspy plugins. Note that the scanner has not tested for these issues but has instead relied on...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +127 more potentially affected by CVE-2018-11776 via org.apache.struts:struts2-core (>=2.5, <=2.5.16)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.0-release, =2.5.0, =2.5.0, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.3 - com.jgeppert.struts2.jquery:struts2-jquery-integration-tests 4.0.3 and more Source cves: CVE-2018-11776 Source advisory: GHSA-CR6J-3JP9-RW65...