Apache Wicket Cross-Site Scripting Vulnerability (CNVD-2017-34180)

Apache Wicket is the United States Apache Apache Software Foundation , a set of open source , lightweight , component-based framework , which provides an object-oriented way to develop Web-based dynamic UI applications . A cross-site scripting vulnerability exists in Apache Wicket. A remote...

SPIP cross-site scripting vulnerability (CNVD-2017-35805)

SPIP is a free Web-based content publishing system. The system is primarily used for online collaboration. A cross-site scripting vulnerability exists in versions of SPIP prior to 3.1.7. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of...

Design/Logic Flaw

An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpaper collection in the webUI to be shown as background on the ClickShare product. By uploading a wallpaper with a specially crafted name, an...

CVE-2017-12460

An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpaper collection in the webUI to be shown as background on the ClickShare product. By uploading a wallpaper with a specially crafted name, an...

CVE-2017-12460

An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpaper collection in the webUI to be shown as background on the ClickShare product. By uploading a wallpaper with a specially crafted name, an...

International Islamic University Chittagong: Email HTML Injection and Possible Stored Cross-Site Scripting in ieeeiiucsb.org

Hello International Islamic University Chittagong I found a Email HTML Injection in ieeeiiucsb.org Summary: add summary of the vulnerability This attack can be use to create a phishing email using your email app Steps To Reproduce: 1. Go to https://ieeeiiucsb.org/registration/ 2. Choose any event...

CVE-2017-12460

Barco ClickShare CSM-1 firmware prior to 1.7.0.3 and CSC-1 firmware prior to 1.10.0.10 are affected. An authenticated user can manage the wallpaper collection via the webUI and, by uploading a wallpaper with a specially crafted name, trigger HTML injection due to non-neutralized output. Impact is...

CVE-2017-12460

An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpaper collection in the webUI to be shown as background on the ClickShare product. By uploading a wallpaper with a specially crafted name, an...

Infogram: HTML injection

hi team ... i found HTML i on https://infogram.com/app//library step .. 1- go to https://infogram.com/app//library 2- choose Report Templates . 3- Use Report Classic 4- click to editdata 5- edit cell Employee ID 5- payload hacked hacked hacked 6-execute HTML .. POC .. video on attached...

CVE-2012-4378

Multiple cross-site scripting XSS vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php...

HTML Injection

github.com/gogits/gogs is vulnerable to HTML injection. The user search API can be used to inject HTML content. An attacker could insert spoofed content to carry out some form of social engineering attack. HTML injection is an attack that is similar to cross-site scripting but does not execute...

IBM OpenPages GRC Platform HTML Injection Vulnerability

IBM OpenPages GRC Platform is a suite of governance, risk and compliance platforms for managing enterprise risk and compliance challenges from IBM in the United States. The platform provides a set of core services and functional components across the risk and compliance domains, including...

Design/Logic Flaw

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712...

CVE-2016-3049

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712...

CVE-2016-3049

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712...

CVE-2016-3049

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712...

CVE-2016-3049

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712...

CVE-2016-3049

IBM OpenPages GRC Platform is affected by CVE-2016-3049: HTML injection in versions 7.1–7.3. A remote attacker could inject HTML that executes in the victim’s browser within the hosting site’s context. IBM’s bulletin lists fixes per version: 7.3 Fix Pack 1 (7.3.0.1) or later, 7.2 Fix Pack 3 (7.2....

GHSA-8QRH-H9M2-5FVF Cross site scripting that affects rails

Cross-site scripting XSS vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper...

Moderate severity vulnerability that affects rails

Cross-site scripting XSS vulnerability in the striptags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and...