Bracket-template Cross-Site Scripting Vulnerability

bracket-template is a JavaScript template library for modern browsers. A cross-site scripting vulnerability exists in bracket-template. This vulnerability can be exploited by a remote attacker to inject malicious code via GET parameters...

Cross site scripting

Cross-site scripting XSS vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php...

SAP MaxDB ODBC Remote Code Injection Vulnerability

SAP MaxDB is Germany SAP SAP company's set of cross-platform, ANSI SQL-92-compatible relational database management system. ODBC driver is one of the ODBC connection driver. A security vulnerability exists in the SAP MaxDB ODBC driver prior to version 7.9.09.07. An attacker can exploit this...

Atlassian Jira issue collector cross-site scripting vulnerability

Atlassian JIRA is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of issues and defects in the workplace. issue collector is one of the issue collectors. A cross-site scripting vulnerability exists in the error message of a...

CVE-2018-0582

Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

phpIPAM cross-site scripting vulnerability (CNVD-2018-09472)

phpIPAM is a set of open source PHP and MySQL based IP address management application IPAM. A cross-site scripting vulnerability exists in the app/sections/user-menu.php file in versions prior to phpIPAM 1.3.1. A remote attacker can exploit this vulnerability to inject arbitrary code or denial of...

Code injection

Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allow remote attackers to gain super-user privileges by leveraging SSH access and incorrect ownership of 1 ConfigureCoreFile.sh, 2 Traceroute.sh, 3 apps.sh, 4 conversionjava2native.sh, 5 coreCompression.sh, 6...

Atlassian Application Links Cross-Site Scripting Vulnerability

Atlassian Application Links is a plug-in from Atlassian Australia that is used in Atlassian products to create buttons that connect to other applications. A cross-site scripting vulnerability exists in several managed application link resources in Atlassian Application Links versions prior to...

XSS in various types of nested wiki markup - CVE-2017-18102

The bundled version of atlassian-renderer in Atlassian JIRA before version 7.7.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in nested wiki markup. For more information see https://jira.atlassian.com/browse/RNDR-153 currently...

iScripts EasyCreate cross-site scripting vulnerability (CNVD-2018-08315)

IScripts EasyCreate is a set of online website builder from Iscripts, Inc. The tool can be used on the server for the client to provide website building services , belong to the fully customizable . A cross-site scripting vulnerability exists in the Site title field in IScripts EasyCreate version...

Cisco IOS XE Cross-Site Scripting Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. A cross-site scripting vulnerability exists in the Web UI in Cisco IOS XE Software, which arises from a program's failure to perform sufficient input validation of parameters sent to the affected software via...

CVE-2018-6882

Cross-site scripting XSS vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite ZCS before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment...

Cross site scripting

Cross-site scripting XSS vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2018-8732

CVE-2018-8732 describes a cross-site scripting (XSS) vulnerability in WampServer 3.1.1 that can be triggered via the virtual_del parameter, allowing remote injection of script/HTML. Multiple connected sources (Exploit-DB, exploit packs, and CVE records) confirm the vulnerability and a CSRF-exploi...

CVE-2018-7707

Affected software : SecurEnvoy SecurMail prior to 9.2.501. Vulnerability : Cross-site scripting (XSS) via an HTML-formatted e-mail message. Root cause / vector : not explicitly detailed beyond the XSS in HTML-format emails; multiple sources attribute vulnerability to improper handling of HTML ema...

PHP Scripts Mall Hot Scripts Clone:Script Classified Cross-Site Scripting Vulnerability

PHP Scripts Mall Hot Scripts Clone:Script Classified is a set of PHP based classifieds posting scripts by PHP Scripts Mall India. A cross-site scripting vulnerability exists in the Add New feature of PHP Scripts Mall Hot Scripts Clone:Script Classified version 3.1, which stems from the program's...

CVE-2018-7277

An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP...

openSUSE Security Update : python-mistune (openSUSE-2018-148)

This update for python-mistune to version 0.8.3 fixes several issues. These security issues were fixed : - CVE-2017-16876: Cross-site scripting XSS vulnerability in the keyify function in mistune.py allowed remote attackers to inject arbitrary web script or HTML by leveraging failure to escape th...

CVE-2017-5124

CVE-2017-5124 is a cross-site scripting (UXSS) vulnerability in the MHTML handling of Chromium/Blink, allowing a remote attacker to inject scripts/HTML via a crafted MHTML page in Google Chrome prior to 62.0.3202.62. Affected software: Google Chrome/Chromium (Blink). Impact: arbitrary script exec...

Code injection

webhooks/base.py in Anymail aka django-anymail before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOKAUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events...