CVE-2017-1278

IBM DOORS Next Generation DNG/RRC 4.0, 5.0 and 6.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124756...

Certec EDV GmbH atvise scada cross-site scripting vulnerability

Certec EDV GmbH is based in Austria. atvise is a web-based HMI monitoring and data acquisition system. A cross-site scripting vulnerability exists in Certec EDV GmbH atvise scada. An attacker may be able to exploit this vulnerability to execute arbitrary script code in the browser of an...

Cross site scripting

Multiple Cross-Site Scripting XSS were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data torrents, size passed to the 'Gazelle-master/sections/tools/managers/multiplefreeleech.php' URL. An attacker could execute arbitrary HTML...

CVE-2017-7247

Multiple Cross-Site Scripting XSS were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data torrents, size passed to the 'Gazelle-master/sections/tools/managers/multiplefreeleech.php' URL. An attacker could execute arbitrary HTML...

Cross site scripting

Multiple Cross-Site Scripting XSS issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data element, state, cat, id, cid passed to the EPESI-master/modules/Utils/Watchdog/subscribe.php URL. An attacker could execute arbitrary HTML and...

Cross site scripting

A Cross-Site Scripting XSS issue was discovered in php-calendar before 2017-03-03. The vulnerability exists due to insufficient filtration of user-supplied data errorMsg passed to the "php-calendar-master/error.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CNVD-2017-02007)

Cisco Unified Communications Manager CUCM, Unified CM is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A cross-site scripting vulnerability exists i...

Wordpress filedownload plugin has unspecified vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language. filedownload is one of the file download plugin. A security vulnerability exists in Wordpress filedownload plugin v1.4, which can be exploited by an attacker to execute malicious code on a...

Splunk cross-site scripting vulnerability (CNVD-2016-05864)

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index and analyze machine-generated data, including data generated by all IT systems and infrastructures physical, virtual and cloud. A cross-site scriptin...

ILIAS Cross-Site Scripting Vulnerability

ILIAS is a Web-based learning management system. It provides course management, email, instant messaging, forums, group collaboration, file sharing, writing tools, exam systems, personal desktops, and more. Provides contextual help system for learning and writing. Supports CAS, SOAP, RADIUS, LDAP...

JVN#56167268: HumHub vulnerable to cross-site scripting

HumHub is a software framework for developing a social networking service SNS. HumHub contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software Update to the latest version according to the information provide...

Achievo cross-site scripting vulnerability (CNVD-2016-03590)

Achievo is a WEB-based project management tool for business environments. A cross-site scripting vulnerability exists in Achievo, where an attacker can execute arbitrary HTML and script code in a user's browser in the context of an affected website due to input filtering errors in parameters...

New Relic: Stored Cross-Site Scripting via Angular Template Injection

It's possible to inject angular expressions into the account settings of a new relic account. This, combined with an angular sandbox escape allows for persistant cross-site scripting which is executed in the browser of any user visiting the affected page. The execution of which could be used to...

Fiyo CMS HTML Injection Vulnerability

Fiyo CMS is a content management system CMS for creating CMS templates. An HTML injection vulnerability exists in Fiyo CMS that stems from the program's failure to adequately filter user-submitted input. When a user browses the affected site, their browser will execute arbitrary HTML or script co...

Imgur: Persistent XSS in image title

When adding a title to uploaded images, one can insert XSS into the title which is then executed for anyone viewing the image. PoC contains a harmless XSS: http://imgur.com/bSZwUBG&rAmpN4O How to recreate: 1. Open the Image Options page for an album. 2. Press "Add Title / Description" 3. Enter so...

JVN#67540183: Simple Oekaki BBS vulnerable to cross-site scripting

Simple Oekaki BBS provided by LEMON-S PHP contains a persistent cross-site scripting CWE-79 vulnerability due to the processing of oekakis parameter in index.php. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version...

Chamilo LMS Cross-Site Scripting Vulnerability

Chamilo LMS is an open source online learning and collaboration system developed by the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. Chamilo LMS suffers from a cross-site scripting vulnerability that ste...

Kallithea Code Injection Vulnerability

Kallithea, a project under the US-based Software Freedom Conservancy organization, is a free source code management system. The system supports Mercurial and Git version control systems, hosting code, managing access control, and more. A code injection vulnerability exists in versions prior to...

Moxa SoftCMS RTSPVIDEO.rtspvideoCtrl.1 ActiveX Stack Buffer Overflow Vulnerability

Moxa SoftCMS is a set of centralized management software for large-scale surveillance systems developed by Moxa. The software supports real-time video surveillance, video playback and event management. A stack buffer overflow vulnerability exists in the RTSPVIDEO.rtspvideoCtrl.1 ActiveX control o...

Palo Alto Traps Server Persistent Cross-Site Scripting Vulnerability

Palo Alto Traps is an advanced endpoint protection package that detects attacks like memory corruption and DLL hijacking. A cross-site scripting vulnerability exists in Palo Alto Traps when handling SOAP requests with embedded JavaScript, which can be exploited by an attacker to execute arbitrary...