CVE-2016-7150

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters...

VK.com: HTML Injection possible due to bad filter

Hello, I have found an area where it may be possible to run certain HTML/JS scripts. TO REPRODUCE: 1. Go to documents 2. Upload anything and edit it 3. On the edit page in tags, enter code without a closing bracket ex. img src=x 4. Click enter 5. It will be parsed in that area, but after saving i...

CVE-2017-5494

Multiple cross-site scripting XSS vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a 1 comment frame or 2 avatar frame...

Malware exploit: Soraya

Type: XSS Author: Xylitol import requests import time def StrToHexstring: hexstr='' for char in string: intchar = ordchar hexnum = hexintchar.lstrip"0x" hexstr+=hexnum return hexstr ConnectUrl = 'http://localhost/something/bot.php' UserString = 'rome0321' HtmlInject =...

U.S. Dept Of Defense: HTML Injection on ████

Summary: HTML Injection vulnerabilities on █████████ Air Base Site. Description: Search value are output without being escaped. HTML Injection via Category parameter...

CVE-2016-3150

Cross-site scripting XSS vulnerability in wallpaper.php in the Base Unit in Barco ClickShare CSC-1 devices with firmware before 01.09.03, CSM-1 devices with firmware before 01.06.02, and CSE-200 devices with firmware before 01.03.02 allows remote attackers to inject arbitrary web script or HTML v...

Multiple F5 BIG-IP Product HTML Injection Vulnerabilities

F5 BIG-IP and EnterpriseManager are both products of F5 USA. The former is an all-in-one network appliance that integrates network traffic management, application security management, load balancing and other functions. The latter is a tool that provides a view of the entire BIG-IP application...

CVE-2016-6837

MantisBT is vulnerable to XSS in the Filter API via the view_type parameter. Affected software includes MantisBT versions before 1.2.19 and versions 2.0.0-beta1, 1.3.0-beta1. The root cause is insufficient input handling of view_type leading to remote script/HTML injection. The provided documents...

Atlassian Confluence HTML Injection Vulnerability

Atlassian Confluence is a professional enterprise knowledge management and collaboration software that can also be used to build enterprise WiKi. An HTML injection vulnerability exists in Atlassian Confluence. An attacker can exploit the vulnerability to execute arbitrary script code in the brows...

CVE-2017-5179

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

ASP.NET Core HTTP Header Injection Vulnerability

ASP.NET Core is a new open source and cross-platform framework for building modern cloud-based applications connected to the Internet such as web applications, Internet of Things IoT applications, and mobile back-end applications. An HTTP header injection vulnerability exists in ASP.NET Core...

CVE-2016-9681

Multiple cross-site scripting XSS vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name...

Hardcoded credentials

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

DEBIAN-CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

CVE-2016-7966

CVE-2016-7966 affects KDE’s KMail plaintext viewer. A crafted URL containing a quote character can inject HTML code due to the URL parser’s handling, limiting inclusion of characters like = or space, but allowing an HTML comment indicator to hide content. This creates a potential HTML injection r...