SAP Business Objects Remote Code Injection Vulnerability

SAP Business Objects is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The program provides reporting, performance management and data base and other functions. A remote code injection vulnerability exists in SAP Business Objects, version 4.0 4.1...

CVE-2018-13001

Sandoba CP:Shop v2016.1 contains a cross-site scripting (XSS) vulnerability in the cpshop/admin.php module. The CVE describes a non-persistent XSS that can be triggered via GET parameters (path, search, rename, or dir) and injected into client-side code. Connected sources corroborate the issue ac...

CVE-2017-13072

The CVE-2017-13072 entry describes a Cross-site scripting (XSS) vulnerability in QNAP QTS App Center affecting QTS 4.2.6 (build 20171208), 4.3.3 (build 20171213), 4.3.4 (build 20171223), and earlier versions. The underlying issue is an XSS flaw that could allow remote attackers to inject Javascri...

Yii2-StateMachine extension for Yii2 cross-site scripting vulnerability (CNVD-2018-11842)

Yii2-StateMachine extension for Yii2 is a demo website system for demonstrating the Yii2 framework. A cross-site scripting vulnerability exists in the Yii2-StateMachine extension for Yii2 version 2.x.x. The vulnerability stems from the program failing to strictly filter the 'role' parameter. A...

CVE-2018-12040

Reflected Cross-site scripting XSS vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an profiler/open?file= URI. NOTE: The vendor states "The XSS ... is in the web profiler, a tool that should...

CVE-2017-3907

Code Injection vulnerability in the ePolicy Orchestrator ePO extension in McAfee Threat Intelligence Exchange TIE Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector...

Bracket-template Cross-Site Scripting Vulnerability

bracket-template is a JavaScript template library for modern browsers. A cross-site scripting vulnerability exists in bracket-template. This vulnerability can be exploited by a remote attacker to inject malicious code via GET parameters...

Cross site scripting

Cross-site scripting XSS vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php...

SAP MaxDB ODBC Remote Code Injection Vulnerability

SAP MaxDB is Germany SAP SAP company's set of cross-platform, ANSI SQL-92-compatible relational database management system. ODBC driver is one of the ODBC connection driver. A security vulnerability exists in the SAP MaxDB ODBC driver prior to version 7.9.09.07. An attacker can exploit this...

Atlassian Jira issue collector cross-site scripting vulnerability

Atlassian JIRA is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of issues and defects in the workplace. issue collector is one of the issue collectors. A cross-site scripting vulnerability exists in the error message of a...

CVE-2018-0582

Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

phpIPAM cross-site scripting vulnerability (CNVD-2018-09472)

phpIPAM is a set of open source PHP and MySQL based IP address management application IPAM. A cross-site scripting vulnerability exists in the app/sections/user-menu.php file in versions prior to phpIPAM 1.3.1. A remote attacker can exploit this vulnerability to inject arbitrary code or denial of...

Code injection

Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allow remote attackers to gain super-user privileges by leveraging SSH access and incorrect ownership of 1 ConfigureCoreFile.sh, 2 Traceroute.sh, 3 apps.sh, 4 conversionjava2native.sh, 5 coreCompression.sh, 6...

Atlassian Application Links Cross-Site Scripting Vulnerability

Atlassian Application Links is a plug-in from Atlassian Australia that is used in Atlassian products to create buttons that connect to other applications. A cross-site scripting vulnerability exists in several managed application link resources in Atlassian Application Links versions prior to...

XSS in various types of nested wiki markup - CVE-2017-18102

The bundled version of atlassian-renderer in Atlassian JIRA before version 7.7.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in nested wiki markup. For more information see https://jira.atlassian.com/browse/RNDR-153 currently...

iScripts EasyCreate cross-site scripting vulnerability (CNVD-2018-08315)

IScripts EasyCreate is a set of online website builder from Iscripts, Inc. The tool can be used on the server for the client to provide website building services , belong to the fully customizable . A cross-site scripting vulnerability exists in the Site title field in IScripts EasyCreate version...

Cisco IOS XE Cross-Site Scripting Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. A cross-site scripting vulnerability exists in the Web UI in Cisco IOS XE Software, which arises from a program's failure to perform sufficient input validation of parameters sent to the affected software via...

CVE-2018-6882

Cross-site scripting XSS vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite ZCS before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment...

Cross site scripting

Cross-site scripting XSS vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2018-8732

CVE-2018-8732 describes a cross-site scripting (XSS) vulnerability in WampServer 3.1.1 that can be triggered via the virtual_del parameter, allowing remote injection of script/HTML. Multiple connected sources (Exploit-DB, exploit packs, and CVE records) confirm the vulnerability and a CSRF-exploi...