GHSA-GHQM-PGXJ-37GQ rails-html-sanitizer Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node...

rack-ssl Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack...

actionview Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple cross-site scripting XSS vulnerabilities in the mailto helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted 1 name or 2 email value...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Paid Memberships Pro PMPro plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 s parameter to membershiplevels.php, 2 memberslist.php, or 3 orders.php in adminpages/ or the 4 edit...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 from parameter to index.php or the 2 pageno parameter to recentchanges.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in 1 inc/inc.ClassUI.php or 2 out/out.DocumentNotify.php...

CVE-2012-4569

Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-15736

CVE-2017-15736 is a stored XSS in SPIP (pre-3.1.7) exploitable via crafted strings in the PGP field, related to prive/objets/contenu/auteur.html and ecrire/inc/texte_mini.php. Affected versions: SPIP before 3.1.7. Remediation: upgrade to SPIP 3.1.7 or later. Exploitation details are not described...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified...

CVE-2010-3659

CVE-2010-3659 concerns multiple cross-site scripting (XSS) flaws in TYPO3 CMS. The vulnerabilities affect TYPO3 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1, allowing remote authenticated backend users to inject arbitrary script/HTML via unspecified paramet...

CVE-2010-3659

Multiple cross-site scripting XSS vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified...

Juniper Junos Space HTML Injection Vulnerability

Juniper Junos Space is a network management solution from Juniper Networks. The solution supports automated configuration, monitoring and troubleshooting of devices and services throughout their lifecycle. An HTML injection vulnerability exists in Juniper Junos Space versions prior to 17.1R1. A...

phpMyFAQ 2.9.8 Cross Site Scripting

Exploit Title: phpMyFAQ 2.9.8 Stored XSS Vendor Homepage: http://www.phpmyfaq.de/ Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: webapps CVE: CVE-2017-1461...

ATutor LMS Cross-Site Scripting Vulnerability

ATutor LMS is an open source web-based learning management system LCMS. The system provides course settings, textbook package downloads, multiple reading options, and other features. A cross-site scripting vulnerability exists in ATutor LMS version 2.2. A remote attacker can exploit this...

CVE-2017-7352

Stored Cross-site scripting XSS vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web script or HTML via the "host" parameter on the 'System Configuration SNMP Add SNMP Trap Manager' screen...

CVE-2014-7240

Cross-site scripting XSS vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a masterresponse action to wp-admin/admin-ajax.php...

CVE-2014-8492

Multiple cross-site scripting XSS vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 sitename, 2 message, or 3 siteurl parameter...

jobs.jobvite.com XSS vulnerability

Open Bug Bounty ID: OBB-323837 Description| Value ---|--- Affected Website:| jobs.jobvite.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-1000109

The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view...