CVE-2017-7897

Summary: CVE-2017-7897 is an XSS vulnerability in MantisBT 2.3.x before 2.3.2, triggered via crafted PATH_INFO in URLs on the Timeline include page used by My View (my_view_page.php) and User Information (view_user_page.php). The root cause is unsanitized $_SERVER['PHP_SELF'] used to generate URL...

CVE-2016-4875

CVE-2016-4875 describes cross-site scripting (CWE-79) vulnerabilities in Geeklog IVYWE edition plugins: Assist (before 1.1.2.test20160906), dataBox (before 0.0.0.20160906), and userBox (before 0.0.0.20160906). The root cause is untrusted input that can be injected into administrator-facing contex...

Asterisk CDR Buffer Overflow Vulnerability (AST-2017-001)

Asterisk is prone to a buffer overflow vulnerability in CDR SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk"; if...

Cross site scripting

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted 'configoption' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3...

CVE-2017-7241

A cross-site scripting XSS vulnerability in the MantisBT Move Attachments page moveattachmentspage.php, part of admin tools allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection CSP settings allows it. This is fixed in 1.3.9, 2.1.3, an...

CVE-2017-6973

CVE-2017-6973 relates to a cross-site scripting (XSS) vulnerability in MantisBT on the Configuration Report page (adm_config_report.php). The issue arises from insufficient sanitization of the crafted action parameter, allowing remote attackers to inject arbitrary code. The vulnerability is fixed...

CVE-2017-7309

CVE-2017-7309 describes a cross-site scripting (XSS) vulnerability in MantisBT’s adm_config_report.php (Configuration Report) where the config_option parameter can be crafted to inject code. Affected software is MantisBT; the vulnerability arises from insufficient input validation on the configur...

MediaWiki Multiple Vulnerabilities (Mar 2015) - Windows

MediaWiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mediawiki:mediawiki"; ifdescripti...

asterisk -- Buffer overflow in CDR's set user

The Asterisk project reports: No size checking is done when setting the user field on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. This allows the possibility of remote code injection...

CVE-2015-8622

Cross-site scripting XSS vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to...

The vulnerability of the McAfee VirusScan Enterprise anti-virus software allows a intruder to inject arbitrary Web or HTML code.

The vulnerability of the McAfee VirusScan Enterprise antivirus software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code remotely...

Apache NiFi Remote Code Injection Vulnerability

Apache NiFi is an automated solution for data transfer between systems. Apache NiFi suffers from a remote code injection vulnerability. An attacker can exploit this vulnerability to execute arbitrary code in the context of a user running in an affected application, with a failed attack resulting ...

CVE-2016-7103

Cross-site scripting XSS vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function...

Code injection

Zyxel USG50 Security Appliance and NWA3560-N Access Point allow remote attackers to cause a denial of service CPU consumption via a flood of ICMPv4 Port Unreachable packets...

CVE-2017-5010

Removed by vendor...

CVE-2017-5006

Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled object owner relationships, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

CVE-2015-8856

Cross-site scripting XSS vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name...

CVE-2016-5204

CVE-2016-5204 affects Chromium-based browsers (Blink SVG image handling). The issue is a cross-site scripting (UXSS) vulnerability caused by SVG shadow DOM handling that can allow script/HTML injection via crafted pages. Desktop/chromium versions prior to 55.0.2883.75 (desktop) and 55.0.2883.84 (...

CVE-2016-5205

CVE-2016-5205 affects Blink in Chromium-based browsers (Chrome/Linux/Windows/Mac) and is a cross-site scripting flaw caused by deferred page-load handling, enabling UXSS via crafted HTML. Affected releases before version 55.0.2883.75 were addressed; advisories indicate upstream fixes in 55.0.2883...

BlackBoard LMS 9.1 SP14 - (Title) Persistent Vulnerability

Document Title: =============== BlackBoard LMS 9.1 SP14 - Title Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1901 Release Date: ============= 2017-01-10 Vulnerability Laboratory ID VL-ID: ====================================...