CVE-2017-6487

CVE-2017-6487 describes multiple XSS vulnerabilities in EPESI 1.8.1.1 due to insufficient filtration of user-supplied data (state, element, id, tab, cid) passed to EPESI-master/modules/Utils/RecordBrowser/favorites.php. Reported impacts: an attacker could inject arbitrary HTML/script code execute...

CVE-2017-6487

Multiple Cross-Site Scripting XSS issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data state, element, id, tab, cid passed to the "EPESI-master/modules/Utils/RecordBrowser/favorites.php" URL. An attacker could execute arbitrary HT...

CVE-2017-6484

Multiple Cross-Site Scripting XSS issues were discovered in INTER-Mediator 5.5. The vulnerabilities exist due to insufficient filtration of user-supplied data c and cred passed to the "INTER-Mediator-master/AuthSupport/PasswordReset/resetpassword.php" URL. An attacker could execute arbitrary HTML...

CVE-2017-6483

Multiple Cross-Site Scripting XSS issues were discovered in ATutor 2.2.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages langcode in themes//admin/systempreferences/languageedit.tmpl.php. An attacker could execute arbitrary HTML and script...

CVE-2017-6489

EPESI ≤ 1.8.1.1 contains multiple Cross-Site Scripting (XSS) flaws due to insufficient sanitization of user-supplied data (element, state, cat, id, cid) passed to the Subscribe endpoint. The identified vulnerable component is EPESI-master/modules/Utils/Watchdog/subscribe.php, which can process un...

PT-2017-17107

Name of the Vulnerable Software and Affected Versions EPESI version 1.8.1.1 Description Multiple Cross-Site Scripting XSS issues were discovered due to insufficient filtration of user-supplied data passed to the "EPESI-master/modules/Utils/RecordBrowser/grid.php" URL. An attacker could execute...

PT-2017-17100

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.2 Description Multiple Cross-Site Scripting issues were discovered due to insufficient filtration of user-supplied data. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable...

CVE-2017-6491: Improper Neutralization of Input During Web Page Generation

Multiple Cross-Site Scripting XSS issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data tooltipid, callback, args, cid passed to the EPESI-master/modules/Utils/Tooltip/req.php URL. An attacker could execute arbitrary HTML and scrip...

CVE-2017-6489: Improper Neutralization of Input During Web Page Generation

Multiple Cross-Site Scripting XSS issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data element, state, cat, id, cid passed to the EPESI-master/modules/Utils/Watchdog/subscribe.php URL. An attacker could execute arbitrary HTML and...

Authorization

An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "server-Lynx-12.11.0/adminconsole/web/tools/XmlJWPlayer.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the contex...

Authorization

An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "whatanime.ga-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the...

CVE-2017-6390

An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "whatanime.ga-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the...

CVE-2017-6391

An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "adminconsole/web/tools/SimpleJWPlayer.php" URL, the "adminconsole/web/tools/AkamaiBroadcaster.php" URL, the "adminconsole/web/tools/bigRedButton.php...

CVE-2017-6390

An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "whatanime.ga-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the...

Authorization

An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "adminconsole/web/tools/SimpleJWPlayer.php" URL, the "adminconsole/web/tools/AkamaiBroadcaster.php" URL, the "adminconsole/web/tools/bigRedButton.php...

CVE-2017-6391

An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "adminconsole/web/tools/SimpleJWPlayer.php" URL, the "adminconsole/web/tools/AkamaiBroadcaster.php" URL, the "adminconsole/web/tools/bigRedButton.php...

Cross site scripting

Multiple Cross-Site Scripting XSS issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/objectsearch.php" URL sectionvalue; srcform. An attacker could execute arbitrary HTML an...

CVE-2017-6393

An issue was discovered in NagVis 1.9b12. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "nagvis-master/share/userfiles/gadgets/stdtable.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable...

Authorization

An issue was discovered in NagVis 1.9b12. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "nagvis-master/share/userfiles/gadgets/stdtable.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable...

CVE-2017-6396

An issue was discovered in WPO-Foundation WebPageTest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "webpagetest-master/www/compare-cf.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerabl...