CVE-2021-25277

FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component...

Session fixation

FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component...

FTAPI 跨站脚本漏洞

A cross-site scripting vulnerability exists in FTAPI 4.0 - 4.10, which allows the passage of a crafted filename to an alternate text hover box in the file submission component...

CVE-2021-25277: Improper Neutralization of Input During Web Page Generation

FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component...

CVE-2020-28409

The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component e.g., a button when events such as click, hover, etc. occur...

CVE-2020-28409

The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component e.g., a button when events such as click, hover, etc. occur...

CVE-2020-28409

The CVE-2020-28409 entry describes a reflected/in-page XSS in Dundas BI up to version 8.0.0.1001, triggered by adding a UI Component (for example, a button) and subsequent events such as click or hover. The vulnerability affects Dundas BI’s server-side handling when these events occur, enabling s...

CVE-2020-28409: Improper Neutralization of Input During Web Page Generation

The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component e.g., a button when events such as click, hover, etc. occur...

CVE-2020-14181

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0...

PT-2020-6782 · Unknown · Beaver Builder

Name of the Vulnerable Software and Affected Versions: Beaver Builder versions up to, and including, 2.5.5.2 Description: The issue arises from insufficient input sanitization and output escaping in the 'Caption - On Hover' value associated with images. This allows authenticated attackers with...

PowerPoint ‘Weakness’ Opens Door to Malicious Mouse-Over Attack

A researcher is sounding the alarm over what he believes could be a novel attack vector which allows a hacker to manipulate a PowerPoint file to download and begin the installation of malware, simply by hovering over a hypertext link. The technique does require a victim to accept one pop-up...

CVE-2019-16683

An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScript payload executes...

CVE-2019-0335

Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console, versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the...

PT-2019-16736 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: moodle versions 3.1 to 3.1.15 moodle versions 3.4 to 3.4.6 moodle versions 3.5 to 3.5.3 moodle versions 3.6 to 3.6.1 Description: A flaw was found in the software where the /userpix/ page did not properly escape users' full names. These names...

CVE-2019-3810: Improper Neutralization of Input During Web Page Generation

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its acces...

GHSA-FWX5-5FQJ-JV98 Cross-Site Scripting in morris.js

Affected versions of morris.js are vulnerable to cross-site scripting attacks in labels that appear when hovering over a particular point on a generated graph. The text content of these labels is not escaped, so if control over the labels is obtained, script can be injected. The script will run o...

CVE-2018-14850

Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image...

CVE-2017-16022

Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded...

ZhaiduMap SQL Injection Vulnerability (CNVD-2018-02954)

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds , site search and other functions. Zh BaiduMap is used in one of the Baidu map component . A SQL injection vulnerability exists in version 3.0.0.1 of Joomla! A...

PowerPoint Malicious Hover Exploit

There exists a malicious downloader vulnerability in Microsoft Office PowerPoint. This is because of the way PowerPoint presentation format handles link hover. A successful attack could lead to malicious files being downloaded...