CVE-2015-4971

IBM Emptoris Strategic Supply Management Platform and Emptoris Program Management are vulnerable to cross-site scripting (XSS) via crafted URLs. The CVE-2015-4971 issue affects 10.x lines (e.g., 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, 10.0.4.x before 10.0.4.0_iFi...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Tivoli Common Reporting TCR 2.1 before IF13 and 2.1.1 before IF21, and TCR 3.1.x as used in Cognos Business Intelligence before 10.2 IF0015 and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Imgur: Reflected Flash XSS using swfupload.swf with an epileptic reloading to bypass the button-event

Hi, This was a fun one. So I noticed you're using swfupload.swf which is hosted on the main domain, imgur.com. This swfupload.swf as some settings you can use to modify the button on the upload. You can actually insert HTML into the Flash, but the button event that you select yourself using anoth...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 version parameter in protected/views/admin/formEditor.php; the 2 importId parameter in protected/views/admin/rollbackImport.php; the 3 bc, 4 fg,...

CVE-2015-5375

Cross-site scripting XSS vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web scrip...

CVE-2015-7383

Multiple cross-site scripting XSS vulnerabilities in Web Reference Database aka refbase through 0.9.6 and bleeding-edge through 2015-04-28 allow remote attackers to inject arbitrary web script or HTML via the 1 adminUserName, 2 pathToMYSQL, 3 databaseStructureFile, or 4 pathToBibutils parameter t...

JSoup Cross-Site Scripting Vulnerability

JSoup is a Java HTML parser , it can be through the DOM, CSS, and JQuery-like operations to take out and manipulate data . Jsoup suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used t...

CVE-2015-4541

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer GRC 5.x before 5.5.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4540

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Identity Management & Governance IMG before 6.8.1 P18 and 6.9.x before 6.9.1 P6 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Identity Management & Governance IMG before 6.8.1 P18 and 6.9.x before 6.9.1 P6 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

The vulnerabilities of Microsoft Lync Server and Skype for Business Server allow attackers to inject arbitrary web or HTML code.

The vulnerability of the jQuery server messaging components in Microsoft Lync Server and Skype for Business Server exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code through a special...

PYSEC-2015-26

Cross-site scripting XSS vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site reque...

CVE-2015-6938

CVE-2015-6938 describes an XSS in the file browser of IPython Notebook/Jupyter Notebook. Affected products are IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5, where a folder name in the file browser notebook/notebookapp.py can be crafted to inject arbitrary web script or HT...

CVE-2015-6972

Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the 1 groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the 2 urlName parameter to plugins/clientcontrol/create-bookmark.jsp;...

CVE-2015-6929

Multiple cross-site scripting XSS vulnerabilities in Nokia Networks formerly Nokia Solutions and Networks and Nokia Siemens Networks @vantage Commander allow remote attackers to inject arbitrary web script or HTML via the 1 idFilter or 2 nameFilter parameter to cftraces/filter/flcopy.jsp; the 3...

CVE-2015-6929

Technical details (affected products/versions, root cause, impact, or fixes) are not publicly available in the provided connected documents. Monitor for updates from official advisories and vendor notices to confirm scope and remediation.

CVE-2015-6945

Cross-site scripting XSS vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to inject arbitrary web script or HTML via the bd parameter to sys/sys/listaBD2.jsp...

Cross site scripting

Cross-site scripting XSS vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an addurltask action to dlm/downloadman.cgi...

Microsoft SharePoint CVE-2015-2522 HTML Injection Vulnerability

Description Microsoft SharePoint is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication...

The vulnerability of the Firefox OS operating system allows a hacker to inject arbitrary HTML code.

The vulnerability of the Gaia Search app for the Firefox OS operating system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code through a special search request executed after the browser...