Palo Alto Networks PAN-OS Cross-Site Scripting Vulnerability (CNVD-2017-06109)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. Palo Alto Networks PAN-OS suffers from a cross-site scripting vulnerability due to the program failing to properly filter user-supplied input. An attacker could exploit the...

Reflected Cross-Site Scripting Vulnerability in 'keyword' Parameter of Qibo B2B Commerce System

Qibo B2B business system is an open source content management system . Qibo B2B Commerce System 'keyword' parameter reflects cross-site scripting vulnerability. Allows attackers to insert XSS execution code into web forms, there are phishing attacks, user cookie theft and other security risks...

MantisBT 2.3.x < 2.3.2 XSS Vulnerability - Windows

MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

Cybozu Office 10.0.0 - 10.5.0 Multiple Security Vulnerabilities

Cybozu Office is prone to multiple security vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cybozu:office";...

Reflected Cross-Site Scripting Vulnerability in 'keyword' Parameter of Qibo Classifieds Information System

Zibo classification information system is an open source content management system. Qibo Classifieds Information System 'keyword' parameter has a reflective cross-site scripting vulnerability that allows an attacker to insert XSS execution code into a web form, which poses a security risk of...

Cross-Site Scripting Vulnerability in C8OA System ID Parameter

C8OA system is a cooperative office system of Anhui XED Software Technology Co. There is a cross-site scripting vulnerability in the ID parameter of the C8OA system that allows an attacker to insert malicious js code into the page to obtain information such as user cookies, leading to user...

Unspecified Cross-Site Scripting Vulnerability in HP Operations Bridge Analytics

HP Operations Bridge Analytics is a suite of intelligent solutions from Hewlett-Packard in the United States that provide operational analytics automation and simplify IT service delivery and digital innovation, among other capabilities. A cross-site scripting vulnerability exists in HP Operation...

Ubiquiti Inc.: [dev-unifi-go.ubnt.com] Insecure CORS, Stealing Cookies

Due to a development designed error page and insecure CORS Header in dev-unifi-go.ubnt.com, the researcher was able to demonstrate how an attacker could steal users cookies by luring the user to access a web page controlled by the attacker...

Stored Cross-site Scripting Vulnerability at YXcmsApp Message Boards

Yxcms is an enterprise building system based on PHP and mysql technology. A stored cross-site scripting vulnerability exists at the YXcmsApp message board. The vulnerability allows an attacker to construct cross-site statements, perform pop-up box operations, and also obtain sensitive information...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

Cisco Unified Communications Manager CUCM, Unified CM is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A cross-site scripting vulnerability exists i...

Stored XSS Vulnerability in EYU Academic Worker Integration Platform

The EYU Academic and Labor Integration Platform is a college and university information content management system. The EYSIP has a stored XSS vulnerability that can be exploited by an attacker to insert malicious js code into a page to obtain user cookies and other information, leading to user...

Stored Cross-Site Scripting Vulnerability in PageAdmin CMS Online Message Feature

PageAdmin CMS is an enterprise building system based on PHP and mysql technology. A stored cross-site scripting vulnerability exists in the online message function of PageAdmin CMS. An attacker can insert malicious js code into the page to obtain user cookies and other information, resulting in...

YxcmsAPP V1.4.3 Stored Cross-site Scripting Vulnerability at Frontend Guestbook

Yxcms is an enterprise building system based on PHP and mysql technology. YxcmsAPP V1.4.3 stored cross-site scripting vulnerability in the front-end guestbook. An attacker can insert malicious js code into the page to obtain user cookies and other information, leading to user hijacking...

Stored Cross-Site Scripting Vulnerability in Converged Smart STB z84

Convergent smart set-top box z84, is a set-top box product of Shenzhen Zhaoneng Xuntong Technology Co., Ltd, is a wireless wifi and smart TV connection set in one device, is widely used in hotels and homes with smart TV set-top box for telecommunication. Converged Smart STB z84 has a stored...

CherryMusic Cross-Site Scripting Vulnerability

CherryMusic is a music streaming server based on CherryPy and jPlayer. A cross-site scripting vulnerability exists in CherryMusic, which can be exploited by an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of an affected site, due to the program...

Reflected Cross-Site Scripting Vulnerability in YXcmsApp V1.4.3 'logout' Function

Yxcms is an enterprise building system based on PHP and mysql technology. A reflective cross-site scripting vulnerability exists in the YXcmsApp V1.4.3 'logout' function. It allows an attacker to construct an XSS statement to perform a pop-up box operation and obtain information such as user...

Stored Cross-Site Scripting Vulnerability in Beijing Topsy's Government Affairs System

Beijing Topsy's government system is an intensive service platform based on cloud PAAS, with all kinds of portal government services, public services as the core, relying on mature big data, cloud computing, mobile Internet, content management, full-text search and other technologies, in accordan...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2017-05371)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMS...

Unspecified Cross-Site Scripting Vulnerability in Trend Micro ServerProtect for Linux

Trend Micro ServerProtect for Linux is an enterprise-grade anti-virus program that runs on Linux. An unspecified cross-site scripting vulnerability exists in Trend Micro ServerProtect for Linux, which is caused by a failure to validate user-submitted data. The vulnerability can be exploited to...

concrete5 cross-site scripting vulnerability (CNVD-2017-05366)

concrete5 is a free content management system CMS developed by Portland Labs in the United States. A cross-site scripting vulnerability exists in concrete5, which stems from the program failing to adequately validate user-supplied input. When an unknowing user browses the affected site, an attack...