CVE-2015-8766

Multiple cross-site scripting XSS vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the 1 emailsendmailfromname, 2 emailsendmailfromaddress, 3 emailsmtpfromname, 4 emailsmtpfromaddress, 5...

CVE-2016-1498

Cross-site scripting XSS vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL...

CVE-2015-8376

Multiple cross-site scripting XSS vulnerabilities in Symphony CMS 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the 1 Name, 2 Navigation Group, or 3 Label parameter to blueprints/sections/edit/1...

CVE-2016-1498

CVE-2016-1498 is an XSS vulnerability in the ownCloud Server OCS discovery provider. It affects the OCS discovery provider component prior to: 7.0.12, 8.0.x prior to 8.0.10, 8.1.x prior to 8.1.5, and 8.2.x prior to 8.2.2, allowing remote attackers to inject arbitrary script via URL vectors. Multi...

CVE-2016-1498

Cross-site scripting XSS vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL...

CVE-2015-8766

Multiple cross-site scripting XSS vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the 1 emailsendmailfromname, 2 emailsendmailfromaddress, 3 emailsmtpfromname, 4 emailsmtpfromaddress, 5...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors...

markdown-it and NodeBB HTML injection vulnerability (CNVD-2016-00135)

markdown-it is a parser product. NodeBB is a forum system developed by the Design Create Play team and built using Node.js, a web application platform built on top of Google's V8 JavaScript engine. An HTML injection vulnerability exists in markdown-it versions prior to 4.1.0 and NodeBB versions...

AVM FRITZ!OS HTML Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Security Advisory ======================================================================= Title: HTML Injection Vulnerability Product: AVM FRITZ!OS Vulnerable Version: All versions prior to 6.30 Fixed Version: 6.30 CVE-ID: CVE-2015-7242 Impact: medium...

Reflected XSS in OCS provider discovery - ownCloud

A Cross-site scripting XSS vulnerability in the OCS discovery provider in ownCloud Servers allows remote attackers to inject arbitrary web script or HTML via the URL resulting in a reflected Cross-Site-Scripting. Since ownCloud employs a strict Content-Security-Policy that forbids inline script...

IBM Curam Social Program Management Cross-Site Scripting Vulnerability

IBM Curam Social Program Management SPM is a suite of social program management solutions from IBM USA. The solution supports the process of end-to-end social program delivery. A cross-site scripting vulnerability exists in IBM Curam SPM version 6.1. A remote attacker can exploit this vulnerabili...

CVE-2015-5447

Cross-site scripting XSS vulnerability in HP StoreOnce Backup system software before 3.13.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Wordpress plugin iframe HTML injection vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. iframe plugin is a pop-up layer allowing external URLs to be loaded into the iframe page plugin . Wordpress...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-5036...

CVE-2015-8508

CVE-2015-8508 is a cross-site scripting (XSS) vulnerability in Bugzilla’s showdependencygraph.cgi. The attacker can inject arbitrary script/HTML via a crafted bug summary when a local dot configuration is used. Affected products/versions include Bugzilla 2.x, 3.x, and 4.x before 4.2.16; 4.3.x and...

WordPress Plugin Google Analytics by Yoast HTML Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blogging sites on servers with PHP and MySQL.Google Analytics by Yoast is one of the web analytics plugins available. An HTML injection vulnerability exists i...

Cross site scripting

Cross-site scripting XSS vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allows remote attackers to inject arbitrary web script or HTML via the errorpage parameter...

Web Analytics Service Cross-Site Scripting Vulnerability

Web Analytics Service is a web analytics server. A cross-site scripting vulnerability exists in the JavaScript module of Web Analytics Service. This allows remote attackers to inject arbitrary web script or HTML code via unspecified vectors...

HTML injection in homescreen app bypassing DOM sanitizer — Mozilla

Mozilla fixed a bug in the l10n localization of the default homescreen app of Firefox OS reported by security researcher Muneaki Nishimura. Exploiting this issue requires tricking the user into bookmarking a specially crafted web page via the 'Add to home screen' functionality. As a result, an...

Symphony HTML Injection Vulnerability

Symphony is a content management system CMS developed using PHP and MySQL. The system supports search engine optimization, module extensions and more. An HTML injection vulnerability exists in Symphony version 2.6.3, which stems from the program not adequately filtering user-submitted input. When...