CVE-2018-0698: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-1000413: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins...

CVE-2018-16199: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an remote attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-16173: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2019-9230

Name of the Vulnerable Software and Affected Versions LogonTracer versions 1.2.0 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For LogonTracer versions 1.2.0 and earlier, at the moment, there is no information...

TWiki bin/statistics cross-site scripting vulnerability

TWiki is a WIKI encyclopedia program. A cross-site scripting vulnerability exists in TWiki bin/statistics. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2018-19993

A reflected cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php...

Cross site scripting

A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to user/card.php...

CVE-2018-19992

A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to adherents/type.php...

CVE-2018-19414

Multiple cross-site scripting XSS vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 keyword parameter to groups.php; 2 username parameter to login.php; or 3 date parameter to search.php...

Fedora 28 : qutebrowser (2018-5c8854a808)

This update fixes an XSS vulnerability on the qute://history page :history. The vulnerability allowed websites to inject HTML into the page via a crafted title tag. This could allow them to steal your browsing history. It also ships some minor fixes not worth mentioning. ---- Add a few minor...

razorCMS HTML Injection Vulnerability (CNVD-2019-00806)

razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. An injection vulnerability exists in razorCMS version 3.4.8. An attacker can use the 'keywords' parameter of the //page page to inject arbitrary HTM...

Cross site scripting

HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...

CVE-2018-19905

HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...

CVE-2018-19905

HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...

CVE-2018-19905

razorCMS 3.4.8 is affected by an HTML injection via the /#/page keywords parameter. The issue concerns the keywords field in that endpoint, enabling arbitrary HTML injection. Remediation hints from PT-2018-15155 suggest restricting access to the /#/page API or stopping use of the keywords paramet...

CVE-2018-19905

HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...

PT-2018-15155 · Razorcms · Razorcms

Name of the Vulnerable Software and Affected Versions: razorCMS version 3.4.8 Description: The issue is related to HTML injection in the software. It can be exploited via the "//page" API endpoint, specifically through the keywords parameter. Recommendations: For razorCMS version 3.4.8, consider...

CVE-2018-19905: Improper Neutralization of Input During Web Page Generation

HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...

Debian DSA-4358-1 : ruby-sanitize - security update

The Shopify Application Security Team discovered that ruby-sanitize, a whitelist-based HTML sanitizer, is prone to a HTML injection vulnerability. A specially crafted HTML fragment can cause to allow nonwhitelisted attributes to be used on a whitelisted HTML element. C Tenable Network Security,...