LavaLite Cross-Site Scripting Vulnerability

LavaLite is an open source lightweight CMS content management system. A cross-site scripting vulnerability exists in the log creation page in LavaLite version 5.2.4. A remote attacker can exploit this vulnerability to cause a denial of service and execute JavaScrpt code...

BookStack Cross-Site Scripting Vulnerability

BookStack is a set of open source using PHP and Laravel to build wiki documentation platform. A cross-site scripting vulnerability exists in BookStack version 0.18.4. A remote attacker can exploit this vulnerability to cause a denial of service and execute JavaScript code...

CVE-2017-1000462

BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code...

CVE-2017-1000482

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

Information disclosure

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...

PYSEC-2018-71

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

PYSEC-2018-71

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

CVE-2017-1000482

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

CVE-2017-1000478

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

CVE-2017-1000478

ELabftw 1.7.8 is vulnerable to a stored cross-site scripting (XSS) flaw in the experiment infos component. The issue arises from unsanitized input stored and executed in the browser, enabling arbitrary JavaScript execution and denial of service. No remediation or patch details are provided in the...

PT-2018-5229

Name of the Vulnerable Software and Affected Versions BookStack version 0.18.4 Description The issue allows for stored cross-site scripting within the page creation page, potentially resulting in disruption of service and execution of javascript code. Recommendations For BookStack version 0.18.4,...

CVE-2017-1000462: Improper Neutralization of Input During Web Page Generation

BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code...

CVE-2017-1000478: Improper Neutralization of Input During Web Page Generation

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

CVE-2017-1000466: Improper Neutralization of Input During Web Page Generation

Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code...

Invoice Ninja Cross-Site Scripting Vulnerability

Invoice Ninja is an open source financial system. The system is able to provide invoicing, collection and other functions. A cross-site scripting vulnerability exists in the invoice creation page in Invoice Ninja version 3.8.1. A remote attacker can exploit this vulnerability to cause a denial of...

CVE-2017-1000467: Improper Neutralization of Input During Web Page Generation

LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code...

PT-2018-5234

Name of the Vulnerable Software and Affected Versions LavaLite version 5.2.4 Description The issue concerns a stored cross-site scripting vulnerability within the blog creation page. This can lead to disruption of service and allow the execution of javascript code. Recommendations For LavaLite...

PT-2018-5233

Name of the Vulnerable Software and Affected Versions Invoice Ninja version 3.8.1 Description The issue allows for stored cross-site scripting, which can be triggered within the invoice creation page. This can lead to disruption of service and execution of javascript code. Recommendations For...

PT-2018-5247

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1 Description The issue allows a member of the Plone site to set JavaScript in the home page property of their profile. This JavaScript is executed when a visitor clicks the home page link on the author page...

PT-2018-5246

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1 Description The issue allows an attacker to potentially trick users into accessing malicious sites or executing attacker-controlled JavaScript after logging in, by exploiting the redirect mechanism that uses t...