CVE-2020-10688

A cross-site scripting XSS flaw was found in RESTEasy, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack...

ovirt-engine: response_type parameter allows reflected XSS

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session...

Microstrategy Library Cross-Site Scripting Vulnerability

Microstrategy is a suite of business analytics and mobility platforms from Microstrategy, Inc.Microstrategy Library is an interactive application for the MicroStrategy platform. A cross-site scripting vulnerability exists in Microstrategy Library. This allows remote attackers to perform reflected...

CVE-2019-1010287

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...

PT-2019-5406 · Red Hat · Openshift Container Platform

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7, openshift-enterprise-3.9 through 3.11 Description: A reflected XSS issue exists in the authorization flow, allowing an attacker to steal...

Cross site scripting

Moxa G3100V2 Series, editions prior to Version 2.8, and OnCell G3111/G3151/G3211/G3251 Series, editions prior to Version 1.7 allows a reflected cross-site scripting attack which may allow an attacker to execute arbitrary script code in the user’s browser within the trust relationship between thei...

GHSA-4QQ9-RRQ6-48FF Cross site scripting in org.apache.nifi:nifi

The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a pri...

CVE-2018-7355

All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. Due to improper neutralization of input during web page generation, an attacker could exploit this vulnerability to conduct reflected XSS or HTML injection...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due...

Cross site scripting

A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain...

User Access Manager <= 2.0.8 - Authenticated Reflected Cross-Site Scripting (XSS)

Not patched in 2.0.0 despite what the advisory states. PoC http://www.example.com/wp-admin/admin.php?page=uamusergroupaction=editusergroup=1%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E%3C%22...

CVE-2016-9457

Revive Adserver before 3.2.3 suffers from Reflected XSS. www/admin/stats.php is vulnerable to reflected XSS attacks via multiple parameters that are not properly sanitised or escaped when displayed, such as setPerPage, pageId, bannerid, periodstart, periodend, and possibly others...

CVE-2016-1000126

Reflected XSS in wordpress plugin admin-font-editor v1.8...

Mail.ru: XSS in https://e.mail.ru/cgi-bin/lstatic (Limited use)

Искал, своими методами, урлы с возможными уязвимостями. Используя google dork: site:mail.ru inurl:ajaxcall, нашёл вот такой: https://e.mail.ru/cgi-bin/lstatic?ajaxcall=1&x-email=oblaka63%40mail.ru&get=balloon&name=14&lang=ruRU&SpamBallonExp=0&SettingsOn=1&staticDomainName=imgsmail.ru Сразу привлё...

Reflected XSS in Create Issue Details page

The Create Issue Detail page is vulnerable to reflected XSS. 1. Login to https://$JIRA/ 2. Visit https://$JIRA/secure/CreateIssueDetails.jspa?reporter="alert'XSS'alert'XSS'p+name%3D"&pid=10000&issuetype=2...

XSS (reflected) in fieldsKeys parameter of GHCreateNewIssue.jspa

Targets: https://test01.jira-dev.com/secure/GHCreateNewIssue.jspa?key=&issueType=7&fieldsKeys=priority,customfield10006,summary,fixVersions,components,customfield10005,assignee,customfield10004,reporter,customfield100039fd29alert'XSS'15d31825f8e9d6606&fieldsValues=1@%@...

XSS Vulnerability in Facebook Translations !

Summary The Facebook Translations tool's search feature was vulnerable to a simple reflected XSS attack. How did it work? The Translations tool allows users to perform phrase searches within translations. In this case, when a search query returned 0 results, the script displayed a message "Your...

Project Forum 6.5.2.2978 Cross Site Request Forgery / Cross Site Scripting

!--========================================================================================================= //\ /\ /\ /\ /\ /\ ///\ //\ /\ /\///\ // \ // //\ \ / //\ \ / // //\ \ /\\ \ \ \ / / / / // \ \ // // // // \ // //\ \\ \ // /// \ \ / \ / // / // / / / / / \ \ / / / ...