Open-Xchange: SSRF - RSS feed, blacklist bypass (IP Formatting)

FYI - Tested on local installation of App Suite 7.8.4 REV 17 Hello, There appears to be a SSRF vulnerability in the below endpoint. This is due to a failure in the App Suite code when evaluating an IP address against a blacklist. The SSRF is limited to scanning hosts on port 80/443 but accuracy i...

Atlassian Confluence XSS Vulnerability

Atlassian Confluence is prone to a cross-site scripting vulnerability through various RSS properties in the RSS macro. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Atlassian Confluence Cross-Site Scripting Vulnerability (CNVD-2018-00231)

Atlassian Confluence is a teamwork software written in Java and used primarily in enterprise environments. A cross-site scripting vulnerability exists in the RSS Feed macro in Atlassian Confluence before 6.5.2. A remote attacker can exploit this vulnerability to inject arbitrary HTML or JavaScrip...

Cross site scripting

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS vulnerabilities in various rss properties which were used as links without restriction on their scheme...

CVE-2017-16856

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS vulnerabilities in various rss properties which were used as links without restriction on their scheme...

CVE-2017-16856

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS vulnerabilities in various rss properties which were used as links without restriction on their scheme...

CVE-2017-16856

CVE-2017-16856 affects Atlassian Confluence via the RSS Feed macro. The issue is a cross-site scripting (XSS) flaw in various RSS properties used as links without restricting their URL scheme, allowing remote injection of HTML/JavaScript. Affected product/version details in provided documents poi...

XSS through various RSS properties in the RSS macro - CVE-2017-16856

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS vulnerabilities in various rss properties which were used as links without restriction on their scheme. h5. Acknowledgements Atlassian would...

XSS through various RSS properties in the RSS macro - CVE-2017-16856

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS vulnerabilities in various rss properties which were used as links without restriction on their scheme. h5. Acknowledgements Atlassian would...

PT-2017-14601

Name of the Vulnerable Software and Affected Versions Atlassian Confluence versions prior to 6.5.2 Description The issue concerns a cross-site scripting XSS vulnerability in the RSS Feed macro of Atlassian Confluence. This vulnerability allows remote attackers to inject arbitrary HTML or JavaScri...

CVE-2017-16856: Improper Neutralization of Input During Web Page Generation

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS vulnerabilities in various rss properties which were used as links without restriction on their scheme...

Cross-site Scripting (XSS)

Wordpress is vulnerable to cross-site scripting XSS attacks. Attackers can inject arbitrary webscript because the enclosure value is not correctly sanitized for RSS and Atom fields...

WordPress Cross-Site Scripting Vulnerability (CNVD-2017-38250)

WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases, or use WordPress as a content management system CMS. A cross-site scripting vulnerability exists in WordPress before 4.9.1. The vulnerability...

Cross site scripting

wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL...

CVE-2017-17094

wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL...

CVE-2017-17094

wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL...

CVE-2017-17094

wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL...

CVE-2017-17094

wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL...

CVE-2017-17094

CVE-2017-17094 affects WordPress core: wp-includes/feed.php in WordPress

PT-2017-14709

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.1 Description The issue is related to the improper restriction of enclosures in RSS and Atom fields in the wp-includes/feed.php file. This might allow attackers to conduct cross-site scripting XSS attacks via a...