Cross-Site Scripting

Overview Affected versions of forms do not properly escape HTML in generated forms, which may result in cross-site scripting. Recommendation Update to version 1.3.0 or later. References - Commit bc01e53 - GitHub Advisory...

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2016-005

Description Inconsistent name for term access query Less critical - Drupal 7 and Drupal 8 Drupal provides a mechanism to alter database SELECT queries before they are executed. Contributed and custom modules may use this mechanism to restrict access to certain entities by implementing...

MGASA-2016-0375 Updated monit packages fix security vulnerability

The forms in Monit's Service Manager are vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host, disable/enable monitoring for a specific service CVE-2016-7067...

WordPress Caldera Forms 1.3.5.3 Cross Site Scripting Vulnerability

WordPress Caldera Forms plugin version 1.3.5.3 suffers from a cross site scripting vulnerability. ------------------------------------------------------------------------ Cross-Site Scripting vulnerability in Caldera Forms WordPress Plugin...

Caldera Forms <= 1.3.5.3 - Cross Site Scripting

The Caldera Forms – More Than Contact Forms WordPress plugin was affected by a Cross Site Scripting security vulnerability...

WordPress Caldera Forms 1.3.5.3 Cross Site Scripting

------------------------------------------------------------------------ Cross-Site Scripting vulnerability in Caldera Forms WordPress Plugin ------------------------------------------------------------------------ Jurgen Kloosterman, July 2016...

CVE-2016-8600

In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...

WordPress Gravity Forms Plugin <= 2.0.6.5 - XSS

This plugin is prone to a cross site scripting vulnerability. It allows attackers to inject arbitrary JavaScript or HTML code. Solution Update the plugin...

Gravity Forms <= 2.0.6.5 - Authenticated Blind Cross-Site Scripting (XSS)

A blind XSS vulnerability exists in the GravityForms plugin prior to version 2.0.7, in the select option dropdown boxes on forms. If the select column is displayed on the gfentries page when viewed in the Dashboard, the code is executed by the admin / viewer of the submissions. This vulnerability...

Adobe Reader DC XFA Uninitialized Pointer Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Adobe Reader DC XFA forms Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CVE-2016-0370

Cross-site scripting XSS vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product...

CVE-2016-0370

IBM Forms Experience Builder 8.5, 8.5.1 and 8.6 are affected by a cross-site scripting (XSS) vulnerability that can be triggered by crafted input in applications built with the product. The root cause is input not being adequately filtered, allowing an attacker with administrator access to cause ...

CVE-2016-0370

Cross-site scripting XSS vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product...

WordPress Ninja Forms Plugin SQL Injection

An SQL injection vulnerability exists in the WordPress Ninja Forms Plugin. It allows an authenticated remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data...

IBM Forms Experience Builder Cross-Site Scripting Vulnerability

IBM Forms Experience Builder is a set of U.S. IBM's Web forms for creating Web site applications. A cross-site scripting vulnerability exists in versions 8.5, 8.5.1, and 8.6 of IBM Forms Experience Builder that stems from the program not adequately filtering user-submitted input. When a user...

WordPress Ninja Forms Plugin <= 2.9.55.1 - Authenticated SQL Injection

There is a bug in this plugin. It could leak the site’s usernames and hashed passwords. Solution Update the plugin...

Ninja Forms <= 2.9.55.1 - Authenticated SQL Injection

The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...

IBM Forms Experience Builder Cross-Site Request Forgery Vulnerability

IBM Forms Experience Builder is a suite of applications for creating Web forms for Web sites. A cross-site request forgery vulnerability exists in IBM Forms Experience Builder that allows a remote attacker to construct a malicious URI, trick a user into parsing it, and perform malicious actions i...