16220 matches found
CVE-2019-10226
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is a XSS protection...
CVE-2019-10226
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is a XSS protection...
Design/Logic Flaw
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is a XSS protection...
CVE-2019-10226
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is a XSS protection...
PT-2019-11643 · Fat Free Crm · Fat Free Crm
Name of the Vulnerable Software and Affected Versions: Fat Free CRM version 0.19.0 Description: A HTML Injection issue has been reported in the Fat Free CRM product, specifically via an authenticated request to the "/comments" URI. The vendor disputes the significance of this report, citing that...
CVE-2019-10226
CVE-2019-10226 concerns HTML Injection in Fat Free CRM 0.19.0 via an authenticated request to /comments. Public documentation notes that the vendor disputed the severity, citing that some HTML formatting is allowed and that there is an XSS protection mechanism. Subsequent entries (GHSA and OSV mi...
CVE-2018-8047
vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...
Shopify: HTML injection in https://interviewing.shopify.com/index.php?candidate=
https://interviewing.shopify.com/index.php?candidate= is inserting the value of candidate into the DOM without any filtering except that the equal sign can't appear in the payload, this allows attacker to injection any html in the DOM. Of course reflected XSS payloads like ...something... will be...
dotCMS 5.1.1 Open Redirection / Cross Site Scripting
Read full vulnerability report @ https://secureli.com/dotcms-v5-1-1-open-redirect-vulnerability/ dotCMS v5.1.1 suffers from an Open Redirect Vulnerability, in addition to many other vulnerabilities that I am still verifying. The following URL is a proof-of-concept that requires a user to be logge...
Cybozu Garoon 4.6.x <= 4.6.3 XSS Vulnerability
Cybozu Garron is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cybozu:garoon...
Cross site scripting
Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Portal'...
Design/Logic Flaw
An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter...
CVE-2019-11845
An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter...
Design/Logic Flaw
An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn or entryDisplayNameIn parameter...
Design/Logic Flaw
/servlets/ajaxfileupload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection...
CVE-2019-11846
/servlets/ajaxfileupload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection...
CVE-2019-11844
An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn or entryDisplayNameIn parameter...
CVE-2019-11846
/servlets/ajaxfileupload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection...
CVE-2019-11844
CVE-2019-11844 affects Ricoh SP 4520DN printers. The vulnerability is an HTML Injection in the web UI, exploitable via /web/entry/en/address/adrsSetUserWizard.cgi parameters entryNameIn or entryDisplayNameIn. Affected component: the web interface handling user/address fields; root cause is unsani...