3892 matches found
CVE-2017-16856
The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS vulnerabilities in various rss properties which were used as links without restriction on their scheme...
CVE-2017-16856
CVE-2017-16856 affects Atlassian Confluence via the RSS Feed macro. The issue is a cross-site scripting (XSS) flaw in various RSS properties used as links without restricting their URL scheme, allowing remote injection of HTML/JavaScript. Affected product/version details in provided documents poi...
XSS through various RSS properties in the RSS macro - CVE-2017-16856
The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS vulnerabilities in various rss properties which were used as links without restriction on their scheme. h5. Acknowledgements Atlassian would...
XSS through various RSS properties in the RSS macro - CVE-2017-16856
The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS vulnerabilities in various rss properties which were used as links without restriction on their scheme. h5. Acknowledgements Atlassian would...
CVE-2017-16856: Improper Neutralization of Input During Web Page Generation
The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS vulnerabilities in various rss properties which were used as links without restriction on their scheme...
Cross-site Scripting (XSS)
Wordpress is vulnerable to cross-site scripting XSS attacks. Attackers can inject arbitrary webscript because the enclosure value is not correctly sanitized for RSS and Atom fields...
WordPress Cross-Site Scripting Vulnerability (CNVD-2017-38250)
WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases, or use WordPress as a content management system CMS. A cross-site scripting vulnerability exists in WordPress before 4.9.1. The vulnerability...
CVE-2017-17094
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL...
Cross site scripting
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL...
CVE-2017-17094
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL...
CVE-2017-17094
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL...
CVE-2017-17094
CVE-2017-17094 affects WordPress core: wp-includes/feed.php in WordPress
CVE-2017-17094: Improper Neutralization of Input During Web Page Generation
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL...
wordpress -- multiple issues
wordpress developers reports: Use a properly generated hash for the newbloguser key instead of a determinate substring. Add escaping to the language attributes used on html elements. Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds. Remove the ability to upload...
WordPress 1.5.0-4.9 - RSS and Atom Feed Escaping
...
WordPress 1.5.0-4.9 - RSS and Atom Feed Escaping
The attributes of enclosures are not correctly escaped in RSS and Atom feeds in wp-includes/feed.php file, which might allow an attacker to exploit XSS via a crafted URL. Solution Update WordPress to v4.9.1...
Apache Roller < 5.0.2 Multiple Vulnerabilities
Apache Roller is prone to code execution and cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Tiny Tiny RSS SQL Injection Vulnerability
Tiny Tiny RSS is an open source RSS Really Simple Syndication reader written in PHP. forgotpass component is one of the password recovery component. A SQL injection vulnerability exists in the classes/handler/public.php file of the forgotpass component in Tiny Tiny RSS version 17.4. A remote...
