Cross-site Scripting (XSS)

mayan-edms is vulnerable to cross-site scripting XSS attacks. The library does not properly escape tag labels, allowing a malicious user to inject and execute arbitrary Javascript...

Cross-site Scripting (XSS)

exceljs is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the cells in the table, allowing a malicious user to inject and execute arbitrary Javascript...

X (Formerly Twitter): HTTPS is not validating TLS mac codes

https://twitterflightschool.com is prone to POODLE and also a stronger variant of POODLE which allows a MITM attacker to actively decrypt bytes from an HTTPS request. This attack is possible because the device terminating this TLS connection responds differently to a bad record mac when the last...

QNAP Photo Station Cross-Site Scripting Vulnerability

QNAP Photo Station is a web-based photo album application from QNAP Systems that supports organizing and sharing photos and movies on a NAS over the Internet. A cross-site scripting vulnerability exists in QNAP Photo Station 5.7.0 and prior versions. A remote attacker can exploit the vulnerabilit...

CVE-2018-0715

Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised application...

PortSwigger Web Security: Browser Self XSS Protection not implemented

Hi Self XSS Protection not used ,An attacker can trick users to insert JavaScript in browser console. A Self-XSS scam usually works by promising to help you access somebody else's account. Instead, the scammer tricks you into gaining access to your account for fraud, spam and tricking more people...

Cross-Site Scripting (XSS)

Mort Bay jetty is vulnerable to cross-site scripting XSS. The server response from a directory listing request is not sanitized and allows an attacker to inject arbitrary Javascript into a victim's browser via a ; semicolon character...

Cross site scripting

Cross-site scripting XSS vulnerability on D-Link DIR-615 routers 20.07 allows an attacker to inject JavaScript into the "Status - Active Client Table" page via the hostname field in a DHCP request...

CVE-2018-15874

Cross-site scripting XSS vulnerability on D-Link DIR-615 routers 20.07 allows an attacker to inject JavaScript into the "Status - Active Client Table" page via the hostname field in a DHCP request...

CVE-2018-15875

Cross-site scripting XSS vulnerability on D-Link DIR-615 routers 20.07 allows attackers to inject JavaScript into the router's admin UPnP page via the description field in an AddPortMapping UPnP SOAP request...

CVE-2018-15874

The connected CNVD entry describes a Cross-Site Scripting (XSS) vulnerability in D-Link DIR-615 routers using version 20.07, exploitable by injecting JavaScript into the Status → Active Client Table via the hostname field in DHCP requests. Affected component: the DHCP hostname handling on DIR-615...

Cross-site scripting vulnerability in multiple IBM products (CNVD-2018-24626)

IBM Rational Collaborative Lifecycle Management CLM is a set of collaborative lifecycle management solutions.Rational Quality Manager RQM is a set of collaborative, web-based quality management solutions. IBM Rational Collaborative Lifecycle Management CLM is a collaborative lifecycle management...

Cross-Site Scripting (XSS)

This is Due to the unescaped quotes in dojox/Grid/DataGrid when editing rows, which would allow an attacker to inject arbitrary HTML and Javascript into a victim's browser. Which makes dojox vulnerable to cross-site scripting...

CVE-2018-10139

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

CVE-2018-10139

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

CVE-2018-10139

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

IBM Rhapsody Model Manager Cross-Site Scripting Vulnerability

IBM Rhapsody Model Manager is a suite of collaborative design model management software from IBM. The software supports the use of centralized system repositories for storing, sharing, searching and managing design models, as well as automated software design reviews. A cross-site scripting...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2018-14693)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A cross-site...

WordPress Mondula Multi Step Form Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . Mondula Multi Step Form is used in one of the drag-and-drop form builder plugin . A cross-site scripting...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2018-13986)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting vulnerability exists in IBM Sterling B...