CVE-2015-2690

CVE-2015-2690 affects FreePBX Digium Addons (digiumaddoninstaller) before 2.11.0.7. Multiple XSS flaws exist in views/add-license-form.php invoked via admin/config.php (type=setup, display=digiumaddons, page=add-license-form, addon=ffa). The attacker can inject script/HTML through any of 12 param...

CVE-2017-2285

The CVE affects WordPress plugin Simple Custom CSS and JS prior to version 3.4. A reflected cross-site scripting (CWE-79) vulnerability allows an attacker to inject arbitrary script, potentially executing in a logged-in user’s browser. The exact attack vectors aren’t specified in the provided doc...

CVE-2017-11460

CVE-2017-11460 is a cross-site scripting (XSS) vulnerability in the DataArchivingService servlet of SAP NetWeaver Portal 7.4. The issue allows remote attackers to inject arbitrary web script or HTML by manipulating the responsecode parameter in shp/shp_result.jsp. Public sources consistently desc...

SUSE-SU-2017:1893-1 Security update for evince

This update for evince fixes the following issues: - CVE-2017-1000083: Remote attackers could have used the comicbook mode of evince to inject shell code. bsc1046856, bgo784630...

SUSE-SU-2017:1894-1 Security update for evince

This update for evince fixes the following issues: - CVE-2017-1000083: Remote attackers could have used the comicbook mode of evince to inject shell code. bsc1046856, bgo784630...

PT-2017-3713

Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.6.0 and earlier Description: A Cross-Site Scripting issue allows attackers to execute unauthorized code or commands via the action input during the activation of a FortiToken. The vulnerability is caused by insufficient...

CVE-2017-1000032

Cross-Site scripting XSS vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parentid parameter to tree.php and drpaction parameter to datasources.php...

SAP GRC Remote Code Injection Vulnerability

SAP GRC is a suite of governance, risk management and compliance solutions from SAP Germany. SAP GRC suffers from a remote code injection vulnerability. It allows an attacker to inject arbitrary code...

Cross-site scripting vulnerability in phpLDAPadmin htdocs/entry_chooser.php file

phpLDAPadmin is a web-based LDAP client that allows easy management of LDAP servers. A cross-site scripting vulnerability exists in the htdocs/entrychooser.php file in phpLDAPadmin 1.2.3 and earlier versions. A remote attacker can inject code with the help of the 'form', 'element', 'rdn' or...

The vulnerability of the software interface of the Android operating system’s Framework, allowing a hacker to inject arbitrary code

The vulnerability of the software interface of the Android operating system’s Framework is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely, using a local malicious application...

The vulnerability of the software interface of the Android operating system’s Framework, allowing a hacker to inject arbitrary code

The vulnerability of the software interface of the Android operating system’s Framework is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely, using a local malware application...

The vulnerability of the nscd library, which provides system calls and core functions of glibc, allows a perpetrator to cause a service failure or implement malicious code.

The vulnerability of the nscd library, which provides system calls and core functions of the glibc library, arises due to incorrect reading of the internal buffer size. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures or inject code by running the...

Code injection

libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service stack consumption via a crafted rule involving hex strings that is mishandled in the yrreemit function, a different vulnerability than CVE-2017-9304...

Cross site scripting

Cross-site scripting XSS vulnerability in FlipBuilder Flip PDF allows remote attackers to inject arbitrary web script or HTML via the currentHTMLURL parameter...

Logsign Remote Code Injection Vulnerability

Logsign is the next generation security information and event management solution for security intelligence, log management and easy compliance reporting. Logsign suffers from a remote code injection vulnerability. An attacker could exploit this vulnerability to execute arbitrary script code with...

CVE-2017-9140

The CVE-2017-9140 issue affects Telerik Reporting for ASP.NET WebForms (Telerik.ReportViewer.WebForms.dll) prior to R1 2017 SP2 (11.0.17.406). It is a reflected XSS vulnerability exploitable via the bgColor parameter to Telerik.ReportViewer.axd, allowing attacker-controlled script/HTML execution ...

CVE-2015-9057

Multiple cross-site scripting XSS vulnerabilities in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allow remote attackers to inject arbitrary web script or HTML via multiple parameters, related to /users/index.htm, /quarantine/spam/manage.htm, /quarantine/spam/whitelist.htm,...

CyberVision Kaa IoT Platform Remote Code Injection Vulnerability

CyberVision Kaa IoT Platform is a multi-purpose middleware platform for IoT from CyberVision USA that enables building complete end-to-end IoT solutions. The CyberVision Kaa IoT Platform suffers from a remote code injection vulnerability. An attacker can exploit this vulnerability to inject and...

CVE-2016-7841

Cross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2017-7897

A cross-site scripting XSS vulnerability in the MantisBT 2.3.x before 2.3.2 Timeline include page, used in My View myviewpage.php and User Information viewuserpage.php pages, allows remote attackers to inject arbitrary code if CSP settings permit it through crafted PATHINFO in a URL, due to use o...