PT-2016-23: Cross-Site Scripting in SAP NetWeaver

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in SAP NetWeaver. Reflected cross-site scripting in the "/com.sapportals.navigation.testComponent.NavigationRequestSniffer" component allows remote attackers to inject arbitrary HTML tags including...

PT-2016-17: Cross-Site Scripting in SAP NetWeaver

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in SAP NetWeaver. Reflected cross-site scripting in the "/com.sap.portal.themes.styleservice.LockingTestPortalComponent" component allows remote attackers to inject arbitrary HTML tags including...

PT-2016-21: Cross-Site Scripting in SAP NetWeaver

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in SAP NetWeaver. Reflected cross-site scripting in the "/com.sap.portal.themes.integrity.personalization", "/com.sap.portal.themes.integrity.url",...

CVE-2016-5165

Cross-site scripting XSS vulnerability in the Developer Tools aka DevTools subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to inject arbitrary web script or HTML via the settings parameter in a...

CVE-2016-5148

CVE-2016-5148 is a cross-site scripting vulnerability in the Blink rendering engine used by Google Chrome. It could allow an attacker to execute arbitrary web script via widget-update related vectors (UXSS). Affected: Chrome on Windows and macOS prior to 53.0.2785.89; Linux prior to 53.0.2785.92....

CVE-2016-7033

Multiple cross-site scripting XSS vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Multiple HTML Injection Vulnerabilities in Red Hat JBoss BPMS

Red Hat JBoss BPMS is a business process management platform from Red Hat that combines all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation, and business process monitoring. Red Hat JBoss BPMS has multiple HTML injection vulnerabilities th...

Title: Multiple Stored XSS and HTML Injection in Edueto. Found...

Title: Multiple Stored XSS and HTML Injection in Edueto. Found by: Skelor...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the template-creation feature in Malware Information Sharing Platform MISP before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 add.ctp, 2 edit.ctp, and 3 ajaxification.js...

CVE-2015-5720

Malware Information Sharing Platform (MISP) versions prior to 2.3.90 expose multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature. Attack vectors involve add.ctp, edit.ctp, and ajaxification.js, enabling remote attackers to inject arbitrary web script or HTML. The p...

Cross site scripting

Cross-site scripting XSS vulnerability in Let's PHP! simple chat before 2016-08-15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Shopify: Open redirect allows changing iframe content in *.myshopify.com/admin/themes/<id>/editor

Hi , I managed to bypass the fix you deployed to the issue I reported in 159522. Apparently this is what the fix does: - Redirecting to https://checkout.shopify.com/ / only is allowed. - For example: victim.myshopify.com/account/logout?returnurl=https://checkout.shopify.com// will work - but...

CVE-2016-3010

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2995, CVE-2016-299...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2956 and CVE-2016-3008...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2995, CVE-2016-299...

CVE-2016-5165

Cross-site scripting XSS vulnerability in the Developer Tools aka DevTools subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to inject arbitrary web script or HTML via the settings parameter in a...

Fortinet FortiAnalyzer and FortiManager 'Filenames' HTML Injection Vulnerability

Fortinet FortiManager is a centralized network security management solution; Fortinet FortiAnalyzer is a centralized network security reporting solution. An HTML injection vulnerability exists in FortiAnalyzer and FortiManager 'Filenames' that could be exploited by an attacker to steal cookie-bas...

OwnCloud Gallery Application HTML Injection Vulnerability

OwnCloud is a free and open source personal cloud storage solution from German company OwnCloud. The solution offers file management, music storage, calendars and more. An HTML injection vulnerability exists in the OwnCloud Gallery Application, which could be exploited by an attacker to steal...

CVE-2015-5399

CVE-2015-5399 affects PHPVibe, a PHPCMS, where versions before 4.21 are vulnerable to a stored XSS in comments. The root cause is untrusted user input being accepted in comments and then rendered, allowing remote authenticated users to inject arbitrary script/HTML. Public references describe the ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in oauthcallback.php on Accellion Kiteworks appliances before kw2016.03.00 allow remote attackers to inject arbitrary web script or HTML via the 1 code, 2 error, or 3 errordescription parameter...