6882 matches found
Ruby Loofah XSS
The vulnerability in the library for processing and transforming HTML/XML code fragments in Ruby Loofah is related to insufficient cleaning of SVG elements in JavaScript. Exploiting this vulnerability allows a remote attacker to inject arbitrary JavaScript code...
Cross site scripting
A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/NewGUI/Acl.asp" is request...
CVE-2018-17989
CVE-2018-17989 affects D-Link DSL-3782 devices (firmware 1.01). A stored XSS vulnerability exists in the device’s web interface, allowing an authenticated attacker to inject a JavaScript/HTML payload into the ACL page. The payload executes when the browser requests "/cgi-bin/New_GUI/Acl.asp". Acc...
PT-2019-9539
Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 version 1.01 Description A stored XSS issue exists in the web interface, allowing authenticated attackers to inject JavaScript or HTML payload inside the ACL page. The injected payload is executed in a user's browser when the...
CVE-2018-19201
A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter...
Cross site scripting
A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter...
CVE-2018-19201
CVE-2018-19201: A reflected XSS in MyBB’s ModCP Profile Editor affects versions before 1.8.20. An attacker can inject JavaScript via the username parameter (remote, network-based). Impact is client-side script execution as described; mitigation is to upgrade to MyBB 1.8.20 (security maintenance r...
CVE-2018-19201
A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter...
Cross-Site Scripting (XSS)
apache activemq is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the refresh parameter to PortfolioPublishServlet.java, and through debug logs or subscribe messages in webapp/websocket/chat.js...
Cross-Site Scripting (XSS)
Apache Struts is vulnerable to cross-site scripting XSS. Improper validation of user-supplied input allows a remote attacker to inject Javascript into a victim's browser through pages xipclient.html and xipserver.html...
Cross-Site Scripting (XSS)
league/commonmark is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via unsafe links using double-encoded HTML entities to steal session tokens or perform unwanted actions on behalf of the user...
PT-2019-2580 · Jenkins · Jenkins Lockable Resources Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Lockable Resources Plugin versions 2.4 and earlier Description: The issue allows attackers to inject arbitrary JavaScript code in web pages rendered by the plugin due to a cross-site scripting vulnerability. This can be exploited by...
PT-2019-10133
Name of the Vulnerable Software and Affected Versions: PHP Scripts Mall Chartered Accountant : Auditor Website version 2.0.1 Description: The issue allows remote attackers to cause a denial of service, resulting in an unrecoverable blank profile. This can be achieved by injecting crafted JavaScri...
PT-2019-10139
Name of the Vulnerable Software and Affected Versions: PHP Scripts Mall Entrepreneur Job Portal Script version 3.0.1 Description: The issue allows remote attackers to cause a denial of service, specifically an outage of profile editing, by injecting crafted JavaScript code into the KeySkills fiel...
CVE-2018-1914
IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...
Cross-Site Scripting in Expedition Migration Tool
Three cross-site scripting XSS vulnerabilities exist in the Palo Alto Networks Migration Tool “Expedition”. Ref MT-926/ CVE-2019-1569; MT-927/ CVE-2019-1570; MT-928, MT-929/ CVE-2019-1571 CVE-2019-1569: Successful exploitation of this issue may allow an authenticated attacker to inject arbitrary...
Cross-Site Scripting (XSS)
nexus-repository is vulnerable to cross-site scripting XSS. A lack of input validation and output sanitization allows a remote attacker to inject arbitrary Javascript into victim's browser through multiple parameters...
Cross-Site Scripting (XSS)
nexus-core is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the repoId and format parameters of the healthCheckFileDetail function, the file name in the File Upload functionality of Staging Upload, the username when...
Cross-Site Scripting (XSS)
github.com/grafana/grafana is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript through the content, url and name parameters under the Dashboard settings. This CVE ID is different from CVE-2018-18623 and CVE-2018-18625...
PT-2019-18962
Name of the Vulnerable Software and Affected Versions Vanilla Forums versions prior to 2.5 Description The issue allows remote attackers to inject arbitrary JavaScript code into any message on the forum via multiple stored XSS. Recommendations For versions prior to 2.5, update to version 2.5 or...