5053 matches found
U.S. Dept Of Defense: Stored XSS at https://www.█████████.mil
Summary: Stored XSS exists at https://www.██████.mil. A user can fill out the form and upload a file containing javascript code to trigger XSS. Description: Stored XSS exists at https://www.████.mil. A user can fill out the form and upload a file containing javascript code to trigger XSS. Impact ...
Nagios Log Server 跨站脚本漏洞
Nagios Log Server is a set of centralized log management, monitoring and analysis software from Nagios, Inc. Nagios Log Server version 2.1.7 cross-site scripting vulnerability, the vulnerability stems from the nagioslogserver configuration snapshotname parameter is not filtered for user input, an...
CVE-2021-23838
An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the mediafilter HTTP request body parameter for the acp interface. The affected parameter accepts malicious client-side script without proper input sanitization. For example, a malicious us...
CVE-2021-23838
An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the mediafilter HTTP request body parameter for the acp interface. The affected parameter accepts malicious client-side script without proper input sanitization. For example, a malicious us...
CVE-2020-4597
IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link a...
CVE-2020-4597
IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link a...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via nested forms. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and...
Concrete5 Cross-Site Scripting Vulnerability (CNVD-2021-03001)
Portlandlabs Concrete5 is a U.S. PortlandLabs, Inc. open source content management system CMS. A cross-site scripting vulnerability exists in Concrete5 version 8.5.4, which stems from a lack of proper validation of client-side data in the name field of index.php/dashboard/express/entries/view/,...
Quixplorer Input Validation Error Vulnerability
QuiXplorer is a web-based file manager that supports document uploading, downloading, searching, editing and more. Quixplorer has an input validation error vulnerability in version 2.4.1 and earlier, which originates from a cross-site scripting attack caused by improper user-supplied input...
Formstone Cross-Site Scripting Vulnerability
Formstone is a front-end component codebase from the Formstone team. Formstone has a security vulnerability in version 1.4.16 and earlier caused by a failure to properly validate user-supplied input in the -target.php and upload-block.php folder in an upload. A remote attacker can exploit this...
Portlandlabs Concrete5 跨站脚本漏洞
Portlandlabs Concrete5 is a U.S. PortlandLabs, Inc. open source content management system CMS. A cross-site scripting vulnerability exists in Concrete5 version 8.5.4, which stems from a lack of proper validation of client-side data in the name field of index.php/dashboard/express/entries/view/,...
XSS Vulnerability in Mercury X18G Router
Shenzhen Meike Star Communication Technology Co., Ltd. general business items include: computer wireless LAN products, computer hardware and software, communication equipment, electronic products, network security equipment technology development, etc.. The Mercury X18G router has an XSS...
CVE-2020-24903
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting XSS caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the...
Formstone 跨站脚本漏洞
Formstone is a front-end component codebase from the Formstone team. Formstone has a security vulnerability in version 1.4.16 and earlier caused by a failure to properly validate user-supplied input in the -target.php and upload-block.php folder in an upload. A remote attacker can exploit this...
QuiXplorer 跨站脚本漏洞
QuiXplorer is a web-based file manager that supports document uploading, downloading, searching, editing and more. Quixplorer has an input validation error vulnerability in version 2.4.1 and earlier, which originates from a cross-site scripting attack caused by improper user-supplied input...
XSS Vulnerability in Cisco RV082 Dual WAN VPN Router
The Cisco RV082 Wireless-N VPN Firewall is an enterprise-class router from Cisco USA. The Cisco RV082 Dual WAN VPN Router suffers from an XSS vulnerability that can be exploited by remote attackers to obtain user cookie information...
FUEL CMS Cross-Site Scripting Vulnerability (CNVD-2021-02035)
FUEL CMS is a content management system based on CodeIgniter. A stored cross-site scripting vulnerability exists in the Blocks/Navigation/Site variable in FUEL CMS 1.4.11. An attacker can exploit this vulnerability to steal cookies...
CVE-2019-20483
An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload, and read another user's cookie and use that to login to the application...
CVE-2019-20483
The CVE-2019-20483 entry concerns Viki Vera version 4.9.1.26180. The vulnerability allows an attacker to set a user’s last name to an XSS payload, which can be used to read another user’s cookie and impersonate the user by using that cookie to log in. This is described across multiple connected s...