PT-2020-12921

Name of the Vulnerable Software and Affected Versions python-markdown2 versions 2.3.8 and earlier Description The issue arises from the mishandling of element names, which can lead to XSS attacks unless a w+ match succeeds. An example of a potential attack involves using element names with specia...

GHSA-5C66-X4WM-RJFX Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN)

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

Dolibarr 7.0.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications CVE-2018-10094 Dolibarr SQL Injection vulnerability Description Dolibarr is an "Open Source ERP & CRM for Business" used by many companies worldwide. It is available through GitHub or as distribution packages e.g .deb package. Threat The...

Dolibarr ERP/CRM 'test_sql_and_script_inject' function cross-site scripting vulnerability

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site scripting vulnerability exists in the...

CVE-2017-17971: Improper Neutralization of Input During Web Page Generation

The testsqlandscriptinject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS...

PT-2017-15133 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 6.0.4 Description: The issue concerns the test sql and script inject function in htdocs/main.inc.php, which fails to block certain event attributes, specifically onclick and onscroll, allowing for cross-site scripting...

DotNetNuke cross-site scripting vulnerability (CNVD-2016-07083)

DotNetNuke DNN is a set of U.S. DNN company supported by Microsoft , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. A cross-site scripting vulnerability exists in the user-profile profile area in DNN...

CVE-2016-7119

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

CVE-2016-7119

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

Cross site scripting

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

CVE-2016-7119

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

CVE-2016-7119: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

PT-2016-7228

Name of the Vulnerable Software and Affected Versions DotNetNuke DNN versions prior to 8.0.1 Description The issue is related to a cross-site scripting XSS vulnerability in the user-profile biography section. This allows remote authenticated users to inject arbitrary web script or HTML via a...

ownCloud: apps.owncloud.com: XSS via referrer

Look at next request: Host: apps.owncloud.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:40.0 Gecko/20100101 Firefox/40.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer:...

WordPress Onclick Show Popup Plugin <= 6.5 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

PT-2014-7019

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.4 Description The issue allows remote attackers to bypass the Same Origin Policy. This can be achieved via a crafted attribute containing a u0000 character. For example, an onclick attribute with a window.open...

CVE-2012-2887

Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving onclick events...

Design/Logic Flaw

Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving onclick events...

CVE-2012-2887

Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving onclick events...

CVE-2012-2887

Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving onclick events...