19841 matches found
CVE-2019-12863
SolarWinds Orion Platform 2018.4 HF3 NPM 12.4, NetPath 1.1.4 allows Stored HTML Injection by administrators via the Web Console Settings screen...
CVE-2019-12863
CVE-2019-12863 affects SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4). The vulnerability is a stored HTML injection via the Web Console Settings screen, reported as an input/output issue in the web interface and attributable to administrators being able to inject HTML. The availab...
PT-2020-9345
Name of the Vulnerable Software and Affected Versions: SolarWinds Orion Platform version 2018.4 HF3 NPM 12.4, NetPath 1.1.4 Description: The issue allows Stored HTML Injection by administrators via the Web Console Settings screen. This can be exploited by administrators with access to the Web...
CVE-2019-12863: Improper Neutralization of Input During Web Page Generation
SolarWinds Orion Platform 2018.4 HF3 NPM 12.4, NetPath 1.1.4 allows Stored HTML Injection by administrators via the Web Console Settings screen...
discord-html not escaping HTML code blocks when lacking a language identifier
Impact Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed. Patches This has been patched in version 2.3.1 Workarounds Escape the characters & before sending plain code blocks to discord-markdown...
CVE-2020-5533
Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
PT-2020-18508
Name of the Vulnerable Software and Affected Versions Aterm WG2600HS versions Ver1.3.2 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which can lead to cross-site scripting. Recommendations For Aterm WG2600HS versions...
sushidream.fr Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1096392 Security Researcher Zodx Helped patch 35 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting sushidream.fr website and its users. Following coordinated...
HTML Injection
marky-markdown is vulnerable to HTML Injection. The vulnerability exists as it improperly validates style attribute in img tag, allowing an attacker to pass malicious value...
HTML Injection
marky-markdown is vulnerable to HTML Injection. The vulnerability exists as it improperly validates youtube.com as the source value of the iframes. An attacker is able to pass in a value such as youtube.com.evil.com and bypass the validation...
Cross site scripting
A cross-site scripting XSS vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter...
HTML Injection
Overview All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but it is possible to bypass the validation with sources where youtube.com is the sub-domain, such as youtube.com.evil.co. This...
HTML Injection
Overview All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. Recommendation This package is no longer maintained. Please upgra...
Cross-site Scripting (XSS)
Overview written is a rich Markdown editor for the web. Note: This package is deprecated EOL Affected versions of this package are vulnerable to Cross-site Scripting XSS. When parsing and converting markdown into HTML, it is possible to inject malicious JavaScript elements that can result in XSS...
CVE-2014-3827
Multiple cross-site scripting XSS vulnerabilities in the MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the 1 edit or 2 add action in the user-users module or the 3 finduser action or the name parameter in a...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the 1 edit or 2 add action in the user-users module or the 3 finduser action or the name parameter in a...
Cross site scripting
Cross-site scripting XSS vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profilefields module...
CVE-2013-1760
The Bug Genie before 3.2.6 has Multiple XSS and HTML Injection Vulnerabilities...
CVE-2013-1760
The CVE-2013-1760 entry refers to The Bug Genie before version 3.2.6, which is reported to have multiple XSS and HTML injection vulnerabilities. The connected documents consistently identify the affected product and version, and classify the issue as XSS/HTML injection without providing specific ...
