Cross site scripting

Cross-site scripting XSS vulnerability in Integration Matters nJAMS 3 before 3.2.0 Hotfix 7, as used in TIBCO BusinessWorks Process Monitor through 3.0.1.3 and other products, allows remote authenticated administrators to inject arbitrary web script or HTML via the users management panel of the w...

Cross site scripting

Cross-site scripting vulnerability in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

Shopify: Cross-site scripting in "Contact customer" form

Hi, I found HTML Injection Vulnerability while admin contact with customer. In this vulnerability admin is attacker whereas customer is victim. Steps to Reproduce: 1. Go to Customers and Click on Customer Email Address. 2. New Pop-Up window will become open, In Customer Message field type this ht...

vermelho.org.br XSS vulnerability

Open Bug Bounty ID: OBB-440572 Description| Value ---|--- Affected Website:| vermelho.org.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Fortinet Fortiweb HTML Injection Vulnerability

FortiWeb is a web application layer firewall developed by Fortinet. An HTML injection vulnerability exists in Fortinet Fortiweb versions prior to 5.8.1 and 5.7.2, which can be exploited by an attacker to execute HTML and script code in the context of an affected site...

Securimage HTML Injection Vulnerability

Securimage is an open source free PHP CAPTCHA script for generating complex CAPTCHA images and CAPTCHA code. An HTML injection vulnerability exists in Securimage 3.6.4 and earlier versions. A remote attacker can send the '$SERVER'HTTPUSERAGENT'' parameter to the exampleform.ajax.php or...

CVE-2017-14077

HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $SERVER'HTTPUSERAGENT' parameter to exampleform.ajax.php or exampleform.php...

Design/Logic Flaw

HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $SERVER'HTTPUSERAGENT' parameter to exampleform.ajax.php or exampleform.php...

CVE-2017-14077

HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $SERVER'HTTPUSERAGENT' parameter to exampleform.ajax.php or exampleform.php...

CVE-2017-14077

CVE-2017-14077 affects Securimage 3.6.4 and earlier. The root issue is HTML injection in the email body triggered by untrusted input from $_SERVER['HTTP_USER_AGENT'] passed to example_form.ajax.php or example_form.php. The vulnerability allows remote attackers to inject arbitrary HTML into messag...

CVE-2017-14077

HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $SERVER'HTTPUSERAGENT' parameter to exampleform.ajax.php or exampleform.php...

LanSweeper 6.0.100.75 - Cross-Site Scripting

LanSweeper - Cross Site Scripting and HTMLi Title: Vulnerability in LanSweeper Date: 16-11-2017 Status: Vendor contacted, patch available Author: Miguel Mendez Z Vendor Homepage: http://www.lansweeper.com Version: 6.0.100.75 CVE: CVE-2017-16841 Vulnerability description -------------------------...

MediaWiki Multiple Vulnerabilities (Nov 2017) - Windows

MediaWiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mediawiki:mediawiki"; if...

CVE-2016-10516

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...

Cross-site Scripting (XSS)

chosen is vulnerable to cross-site scripting XSS attacks. The library does not escape the optgroup label when appending to HTML, allowing a malicious user to inject and execute arbitrary Javascript...

D-Link DSL-2740E HTML Injection Vulnerability

The D-Link DSL-2740E is a wireless router product from AUO D-Link. A security vulnerability exists in the D-Link DSL-2740E version 1.00BG20150720, which originates from the program failing to properly filter user-submitted input. A remote attacker can exploit the vulnerability to execute arbitrar...

CVE-2017-1000144

Mahara 1.9 before 1.9.6 and 1.10 before 1.10.4 and 15.04 before 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javascript into an institution display name, which will be displayed to other users unescaped on some Mahara system pages...

CVE-2017-1000144

Mahara 1.9 before 1.9.6 and 1.10 before 1.10.4 and 15.04 before 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javascript into an institution display name, which will be displayed to other users unescaped on some Mahara system pages...

CloudBees Static Analysis Utilities and DRY plugin cross-site scripting vulnerability

CloudBees Static Analysis Utilities is the United States CloudBees company's Jenkins Java-based development of continuous integration tools in a static analysis tool . DRY Plugin is one of the analysis report generation plug-in . A cross-site scripting vulnerability exists in the Details view in...

Shopify: Self-XSS in password reset functionality

Hi, When I opened this domain of yours, https://accounts.shopify.com/password-reset/new I just put the following text into email address box, [email protected] it change the colour of the text. Well my point here is that if you could inject HTML, you might be able to add a tag to the page. I...