CVE-2018-8046

The CVE-2018-8046 issue affects Sencha Ext JS 4–6 prior to 6.6.0. The getTip() method in Action Columns unescapes HTML-escaped data, enabling cross-site scripting if tooltips contain user-controlled content. Public information confirms vulnerability details and that a fix was released in 6.6.0 (w...

CVE-2018-8046: Improper Neutralization of Input During Web Page Generation

The getTip method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip method of Action Column...

PT-2018-18404

Name of the Vulnerable Software and Affected Versions: Sencha Ext JS versions 4 through 6.5.3 Description: The issue concerns the getTip method of Action Columns, which is susceptible to cross-site scripting XSS attacks. This occurs even when HTML-escaped data is passed, as the method un-escapes...

extjs getTip() Cross Site Scripting Vulnerability

Exploit for jsp platform in category web applications A XSS vulnerability exists in the getTip method of Action Columns. The Ext JS framework brings no built-in XSS protection, meaning that developers are responsible for sanitizing their output. However. the method above takes HTML-escaped data a...

CVE-2018-1000557

OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting XSS vulnerability in login form and search functionality that can result in An attacker is able to execute arbitrary javascript code within a victims' browser. This attack appear to be exploitable via Victim mus...

CVE-2018-1000513

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting XSS vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x...

CVE-2018-1000513

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting XSS vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x...

CVE-2018-1000513

LimeSurvey 3.0.0-beta.3+17110 contains an XSS in Boxes that can execute JavaScript in admin sessions. The vulnerability arises from the program failing to filter the Destination parameter and could be exploited remotely; it is stated to be fixed in 3.6.x. Connected sources corroborate the XSS imp...

CVE-2018-1000513: Improper Neutralization of Input During Web Page Generation

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting XSS vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x...

PT-2018-9411

Name of the Vulnerable Software and Affected Versions LimeSurvey versions prior to 3.6.x Description The issue is related to a Cross Site Scripting XSS vulnerability in Boxes, which can lead to JS code execution against LimeSurvey admins. Recommendations For versions prior to 3.6.x, update to...

JS Support Ticket < 2.0.6 - CSRF

The JS Help Desk – Best Help Desk & Support Plugin WordPress plugin was affected by a CSRF security vulnerability...

CVE-2018-12581

An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature...

PT-2018-11267

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.8.2 Description A Cross-Site Scripting issue has been found where an attacker can use a crafted database name to trigger an attack when that database is referenced from the Designer feature. The issue is related ...

CVE-2018-12581: Improper Neutralization of Input During Web Page Generation

An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature...

VOOKI - Web Application Vulnerability Scanner

Vooki is a free web application vulnerability scanner. Vooki is a user-friendly tool that you can easily scan any web application and find the vulnerabilities. Vooki includes Web Application Scanner, Rest API Scanner, and reporting section. Vooki – Web Application Scanner can help you to find the...

Fedora Update for nodejs-uri-js FEDORA-2018-13e08f4b4a

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 27 : nodejs-JSV / nodejs-uri-js (2018-13e08f4b4a)

Update to latest nodejs-uri-js for CVE fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

[SECURITY] Fedora 27 Update: nodejs-uri-js-4.2.2-2.fc27

URI.js is an RFC 3986 compliant, scheme extendable URI parsing/validating/resolving library for all JavaScript environments browsers, Node.js, etc...

Fedora Update for nodejs-uri-js FEDORA-2018-373bbbd408

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

js-given code execution vulnerability

js-given is a developer-oriented , BDD for JavaScript Behavior Driven Development, Behavior Driven Development tools . A security vulnerability exists in js-given that originates when the program downloads binary resources over the HTTP protocol. A remote attacker could exploit the vulnerability ...