bootstrap: XSS in the tooltip data-viewport attribute

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting, caused by improper validation of user-supplied input by the tooltip data-viewport attribute. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hosting W...

PT-2019-12140 · Thinkadmin · Thinkadmin

Name of the Vulnerable Software and Affected Versions: ThinkAdmin version 4.0 Description: The issue concerns the applicationadmincontrollerUser.php file in ThinkAdmin V4.0, where it fails to prevent the continued use of an administrator's cookie-based credentials after a password change. This...

Trend Micro Smart Protection Server Cross-Site Scripting Vulnerability

Trend Micro Smart Protection Server is the next generation of cloud-based advanced protection solutions. Trend Micro Smart Protection Server suffers from a cross-site scripting vulnerability that could allow an attacker to steal cookie authentication credentials, execute arbitrary scripts, and mo...

SAP Customer Relationship Management (CRM) WebClient UI Cross-Site Scripting Vulnerability

SAP Customer Relationship Management is a customer relationship management solution. A cross-site scripting vulnerability exists in the SAP Customer Relationship Management CRM WebClient UI. A remote attacker could exploit the vulnerability to execute arbitrary script code in an unsuspecting user...

Unspecified HTML Injection Vulnerability in Zimbra Collaboration Suite

Zimbra Collaboration is a suite of email and collaboration solutions from Zimbra USA. The solution offers email, contacts, calendaring, file sharing, social networking, and more. An unspecified HTML injection vulnerability exists in Zimbra Collaboration Suite. An attacker could exploit the...

Palo Alto PAN-OS Cross-Site Scripting Vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. Palo Alto Networks PAN-OS suffers from a cross-site scripting vulnerability that stems from a failure to adequately validate user input. An attacker could use this vulnerability to...

IBM Cognos Business Intelligence Server Cross-Site Scripting Vulnerability

IBM Cognos Business Intelligence BI Server is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards and scorecards, and can assist companies in adjusting their decisions by analyzing key factors and key stakeholders. A cross-site...

Clickjacking Vulnerability in HP Diagnostics

HP Diagnostics is a suite of end-to-end application management, monitoring, diagnostic analysis and troubleshooting solutions from Hewlett-Packard. A clickjacking vulnerability exists in HP Diagnostics. An attacker could exploit this vulnerability to steal cookie-based authentication credentials...

Multiple F5 BIG-IP Product HTML Injection Vulnerabilities

F5 BIG-IP and EnterpriseManager are both products of F5 USA. The former is an all-in-one network appliance that integrates network traffic management, application security management, load balancing and other functions. The latter is a tool that provides a view of the entire BIG-IP application...

Samsung DVR Design Vulnerability

Samsung DVRs are small PCs used to record TV broadcasts, cable or DirectTV transmissions. Samsung DVR design vulnerability. Since the Samsung DVR web browser defaults to using HTTP port 80 to transmit base64-encoded credentials in the cookie header and base64-encodes only the login and password. ...

Accellion Kiteworks Cross-Site Scripting Vulnerability

Accellion Kiteworks is the leading private cloud platform for secure content. A cross-site scripting vulnerability exists in versions of Accellion Kiteworks prior to 2016.03.00 due to the program failing to properly filter user-supplied parameters. Allowing an attacker to exploit the vulnerabilit...

Multiple Cross-Site Scripting Vulnerabilities in Drupal Webform Module

Drupal is a developmental CMF Content Management Framework written in the PHP language. Multiple cross-site scripting vulnerabilities exist in the Drupal Webform module. Because the application fails to properly filter user-supplied input, an attacker could exploit the vulnerabilities to execute...

Loxone Smart Home Cross-Site Request Forgery Vulnerability

Loxone Smart Home is a WEB-based application. Loxone Smart Home suffers from a cross-site request forgery vulnerability that allows attackers to steal cookie-based authentication credentials and perform unauthorized operations...

Cisco Meraki Systems Manager HTML Injection Vulnerability

Cisco Meraki Systems Manager is a cloud-based management solution. An HTML injection vulnerability exists in Cisco Meraki Systems Manager, which could be exploited by an attacker to obtain cookie-based authentication credentials and execute arbitrary script or HTML code in the context of an...

Multiple Input Validation Vulnerabilities in Gecko CMS

Gecko CMS is a content management system CMS based on PHP and MySQL. Gecko CMS suffers from SQL injection, cross-site scripting, and HTML injection vulnerabilities because it fails to adequately filter user-supplied input. Exploitation of these vulnerabilities allows attackers to perform...

TYPO3 Content Rating Cross-Site Scripting Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in TYPO3 Content Rating, which could be exploited by attackers to conduct cross-site attacks and steal cookie-based authentication...

Land Down Under BBCode HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10435/info Land Down Under is prone to an HTML injection vulnerability. This issue is exposed through their BBCode implementation. Exploitation could permit theft of cookie credentials, manipulation of content, or other...

Invision Power Board 1.x/2.0.3 SML Code Script Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12607/info Invision Power Board is reported prone to a JavaScript injection vulnerability. It is reported that the SML Code 'COLOR' tag is not sufficiently sanitized of malicious script content. Since this could permit an...

phpMyRecipes - Multiple HTML Injection Vulnerabilities

phpMyRecipes - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/58160/info phpMyRecipes is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code could be executed in the...

Horde 3.3.5 - '/Administration Interface admin/sqlshell.php?PATH_INFO' Cross-Site Scripting

source: https://www.securityfocus.com/bid/37351/info Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...