The vulnerability of Adobe Experience Manager’s content and media management system lies in its lack of protection for website structures. This allows attackers to execute arbitrary JavaScript code in the user’s browser.

The vulnerability of the Adobe Experience Manager content and media management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code in the user’s browser remotely...

Cross-Site Scripting (XSS)

moodle/moodle is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the Chapter name in book on the "Add new chapter" page...

Cross-Site Scripting (XSS)

october/backend is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript code in a user's browser via a malicious SVG file upload...

CVE-2020-15275 malicious SVG attachment causing stored XSS vulnerability in MoinMoin

MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrad...

Cross-Site Scripting (XSS)

prestashop/contactform is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the message field...

Cross-Site Scripting (XSS)

github.com/hashicorp/nomad is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute JavaScript in a user's browser via a malicious workload in the cluster. The user's browser executes the file when it is displayed in its raw form from the API or UI...

HomeAutomation 3.3.2 - Persistent Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit: HomeAutomation 3.3.2 - Persistent Cross-Site Scripting Author: LiquidWorm Vendor: Tom Rosenback and Daniel Malmgren Product web page: http://karpero.mine.nu/ha/ Affected version: 3.3.2 Tested on: Apache/2.4.41 centos...

Thrive Smart Home v1.1 Reflected Cross-Site Scripting

Summary As smart home technology becomes more affordable and easy to install with services offered by Thrive Smart Homes, there are some great options available to give your home a high-tech makeover. If the convenience of feeding your cat or turning on your air conditioning with a tap on your...

Cross site scripting

An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking IP addresses using the web management interface. It seems that the device does not implement any cross-site scripting forgery protection...

Drupal Site Verify Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site footing vulnerability exists in the Drupal Site Verify module, which stems from the program failing to adequately validate user input. An attacker can exploit...

Backdrop CMS 1.7.1 Cross Site Scripting Vulnerability

Backdrop CMS versions 1.7.1 and below suffer from a persistent cross site scripting vulnerability. I. VULNERABILITY ------------------------- Backdrop CMS Content types - Add content type And post: POST /backdrop/admin/structure/types/add HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 Windows N...

HTML Injection Vulnerability in Multiple EMC Products

EMC is a U.S. information storage information technology company.EMC RSA Identity Management and Governance is an enterprise-class identity management solution. An HTML injection vulnerability exists in multiple EMC products. A remote attacker with low privileges could exploit the vulnerability t...

BitTorrent API Cross-Site Scripting Vulnerability

BitTorrent is a set of peer-to-peer file uploading and downloading software based on the BitTorrent protocol from the American company BitTorrent. A cross-site scripting vulnerability exists in BitTorrent. An attacker can exploit this vulnerability to execute arbitrary script code in the browser ...

CVE-2016-6606

An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector...

CVE-2016-6606

An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector...

Barco ClickShare Cross-Site Scripting Vulnerability

ClickShare is Barco's wireless presentation collaboration system that allows all participants to share content on a centralized conference room screen. A cross-site scripting vulnerability exists in Barco ClickShare because it does not adequately filter user-supplied input. A remote attacker coul...

"New appointment" function in Cybozu Garoon vulnerable to cross-site scripting

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. "New appointment" function in Cybozu Garoon contains a cross-site scripting vulnerability. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under...

ClipBucket cross-site scripting vulnerability (CNVD-2016-06481)

ClipBucket is an open source video sharing software developed by Arslan team. The software allows you to share videos to video sites and supports the lights off effect when watching a movie. ClipBucket suffers from a cross-site scripting vulnerability. Because the program fails to properly filter...

Multiple HTML Injection Vulnerabilities in Fortinet FortiCloud

Fortinet FortiCloud is a hosted security management and log retention service for the FortiGate product line. Multiple HTML injection vulnerabilities exist in Fortinet FortiCloud. Because the program fails to properly filter user input, an attacker could exploit the vulnerabilities to execute...

Infor CRM 8.2.0.1136 - Multiple HTML Script Injection Vulnerabilities

Infor CRM 8.2.0.1136 - Multiple HTML Script Injection Vulnerabilities Infor CRM 8.2.0.1136 Multiple HTML Script Injection Vulnerabilities Vendor: Infor Product web page: http://www.infor.com Affected version: 8.2.0.1136 Summary: Infor® CRM, formerly Saleslogix, is an award-winning customer...