Cross site request forgery (csrf)

Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...

CVE-2017-7556

Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...

Cross site scripting

A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker may be able to upload a malicious script that attempts to redirect users to a...

CVE-2017-9655

A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker may be able to upload a malicious script that attempts to redirect users to a...

CVE-2017-9655

A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker may be able to upload a malicious script that attempts to redirect users to a...

CVE-2017-7556

It was found that hawtio contains a CSRF flaw that allows unrelated websites to perform actions as the authenticated user. Attackers could use this vulnerability to trick the user to visit his website that contains a malicious script which can be submitted to hawtio server on behalf of the user...

Cross-site Scripting (XSS)

Overview com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Cross-site Scripting XSS via an invalid portletId. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious...

MySQL Dumper Cross-Site Scripting Vulnerability

MySQL Dumper is a MySQL database backup script written in PHP and Perl. A cross-site scripting vulnerability in MySQL Dumper allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...

kitto cross-site scripting vulnerability

kitto is an interactive dashboard framework written using Elixir. A cross-site scripting vulnerability exists in the kitto 404 page, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user...

Adobe Connect HTML Injection Vulnerability

Adobe Connect is web conferencing software. Adobe Connect suffers from a cross-site scripting vulnerability in its implementation, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack a user...

Apache OpenMeetings Cross-Site Scripting Vulnerability (CNVD-2017-23479)

Apache OpenMeetings is audio and video conferencing software. Apache OpenMeetings suffers from a cross-site scripting vulnerability in its implementation, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to...

EMC RSA Archer Cross-Site Scripting Vulnerability

EMC RSA Archer is an enterprise IT governance and compliance governance product from EMC Corporation EMC. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. A cross-site scripting vulnerability exists in EMC RSA Archer. A...

Elasticsearch Kibana Cross-Site Scripting Vulnerability (CNVD-2017-15521)

Elasticsearch Kibana is a suite of open source, browser-based tools for analyzing and searching Elasticsearch dashboards. A cross-site scripting vulnerability exists in Elasticsearch Kibana, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which...

XSS Vulnerability in Emlog Blog System

emlog 5.3.1 is a PHP and MySQL based blog and CMS builder. An XSS vulnerability exists in the Emlog blog system. It allows an attacker to insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...

WordPress No External Links plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress No External Links plugin, which allows attackers to inject...

Mozilla: Use-after-free in frame selection (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

CVE-2016-0255

IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the securi...

Cross site scripting

IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the securi...

CVE-2016-0255

IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the securi...

U.S. Dept Of Defense: Cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @sp1d3rs was able to demonstrate this vulnerability by crafting a specially...