Ian Dunn: HTML injection-WordCamp Talks plugin

This report was about the possibility to inject malicious HTML into wp-admin via comments on the talks post type. Examples of malicious input were: The report suggested that those input could be used in phishing attacks, since the images would be displayed in wp-admin, where an administrator migh...

CVE-2014-2045

Multiple cross-site scripting XSS vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 300 allow remote attackers to inject arbitrary web script or HTML via the username when 1 logging in or 2 creating an account in the old interface, 3 username when creating an accou...

HTML Injection Vulnerability in Multiple EMC Products

EMC Documentum WebTop is a suite of products that allow users to access Documentum repositories and content management services in a standard browser application.Documentum Administrator is a set of Web-based development tools for performing Documentum system administration tasks. Documentum...

b2evolution Multiple XSS Vulnerabilities

b2evolution is prone to multiple cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Design/Logic Flaw

Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

CVE-2016-5208

Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

CVE-2016-5204

Removed by vendor...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bugs 104552 and 104703...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bugs 103997, 104413, 104414, 104777, and 104791...

Cross site scripting

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name...

CVE-2016-7150

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters...

VK.com: HTML Injection possible due to bad filter

Hello, I have found an area where it may be possible to run certain HTML/JS scripts. TO REPRODUCE: 1. Go to documents 2. Upload anything and edit it 3. On the edit page in tags, enter code without a closing bracket ex. img src=x 4. Click enter 5. It will be parsed in that area, but after saving i...

CVE-2017-5494

Multiple cross-site scripting XSS vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a 1 comment frame or 2 avatar frame...

Malware exploit: Soraya

Type: XSS Author: Xylitol import requests import time def StrToHexstring: hexstr='' for char in string: intchar = ordchar hexnum = hexintchar.lstrip"0x" hexstr+=hexnum return hexstr ConnectUrl = 'http://localhost/something/bot.php' UserString = 'rome0321' HtmlInject =...

U.S. Dept Of Defense: HTML Injection on ████

Summary: HTML Injection vulnerabilities on █████████ Air Base Site. Description: Search value are output without being escaped. HTML Injection via Category parameter...

CVE-2016-3150

Cross-site scripting XSS vulnerability in wallpaper.php in the Base Unit in Barco ClickShare CSC-1 devices with firmware before 01.09.03, CSM-1 devices with firmware before 01.06.02, and CSE-200 devices with firmware before 01.03.02 allows remote attackers to inject arbitrary web script or HTML v...

Multiple F5 BIG-IP Product HTML Injection Vulnerabilities

F5 BIG-IP and EnterpriseManager are both products of F5 USA. The former is an all-in-one network appliance that integrates network traffic management, application security management, load balancing and other functions. The latter is a tool that provides a view of the entire BIG-IP application...

CVE-2016-6837

MantisBT is vulnerable to XSS in the Filter API via the view_type parameter. Affected software includes MantisBT versions before 1.2.19 and versions 2.0.0-beta1, 1.3.0-beta1. The root cause is insufficient input handling of view_type leading to remote script/HTML injection. The provided documents...

Atlassian Confluence HTML Injection Vulnerability

Atlassian Confluence is a professional enterprise knowledge management and collaboration software that can also be used to build enterprise WiKi. An HTML injection vulnerability exists in Atlassian Confluence. An attacker can exploit the vulnerability to execute arbitrary script code in the brows...