Visma Public: Able to continue user creation process after deleting the HTML element that shows the message that the session is closed

Summary: Able to continue user creation process and successfully submit the user creation form after deleting the HTML element that shows the message that the session is closed after signing out in different tab from same browser. Steps To Reproduce: 1. Login to...

HackerOne: 404-response contains debug-information with all headers

Summary: When requesting a page that does not exist under www.hackerone.com the page returns a hidden HTML-element debugData that reflects all headers in the GET-request, including http-only cookies. Description: This in itself is not a serious vulnerablity, but as the program description mention...

Cross site scripting

XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element...

CVE-2019-12313

XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element...

CVE-2019-12313

XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element...

CVE-2019-12313: Improper Neutralization of Input During Web Page Generation

XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element...

phpBB: CSS injection via BB code tag "█████"

The input to the "█████" BBcode tag is not properly filtered. It gets converted into a CSS style attribute for a span HTML element. Quotes " are removed, so there's no way to break out of the CSS style attributed. However it is possible to arbitrarily dress the resulting span element. To illustra...

WordPress 4.0.x < 4.0.21 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

Design/Logic Flaw

wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...

Cross-Site Scripting (XSS)

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Cross Site Scripting XSS allows clients to inject scripts into a request and have th...

DOM-based Cross-Site Scripting (XSS)

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Unlike traditional Cross-Site Scripting XSS, where the client is able to inject...

CVE-2015-6665

Cross-site scripting XSS vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag...

CVE-2015-6665

Removed by vendor...

CVE-2015-6665

Cross-site scripting XSS vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag...

CVE-2015-6665: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag...

CVE-2015-5622

Cross-site scripting XSS vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.ph...

CVE-2015-5622

CVE-2015-5622 concerns the robustness of WordPress shortcode HTML tag filtering. The patch tightened the parsing in wp-includes/kses.php and related shortcode handling, with fixes released around WordPress 4.2.x and culminating in WordPress 4.2.3. Debian advisories also note fixes for this CVE in...

CVE-2015-4294: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted URL that leverages incomplete filtering of HTML elements, aka Bug ID CSCut41766...

CVE-2014-6365: Improper Input Validation

Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML document, aka "Internet Explorer XSS Filter Bypass Vulnerability," a different vulnerability than CVE-2014-6328...

KMail 1.x HTML Element Handling Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20539/info KMail is prone to an unspecified denial-of-service vulnerability. An attacker can exploit this issue to crash the affected application, denying service to legitimate users. KMail 1.9.1 and prior versions are...