487 matches found
CVE-2018-11326
An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack...
CVE-2018-11326: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack...
CVE-2018-8832
enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...
CVE-2018-8832
enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...
Design/Logic Flaw
enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...
CVE-2018-8832
enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...
CVE-2018-8832
enhavo 0.4.0 (PHP Symfony-based CMS) has a cross-site scripting vulnerability where a user-group name can contain executable JavaScript. The attack triggers when a victim visits the admin user group page, indicating that the vulnerable input is not properly sanitized on that page. The available s...
CVE-2018-8832
enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...
CVE-2018-8832: Improper Neutralization of Input During Web Page Generation
enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...
User Group Privilege Vulnerability in Damon Database
DM7 is a new-generation database product designed by Damon on the basis of summarizing the R&D and application experience of DM series products, absorbing the advantages of mainstream database products and adopting JAVA-like virtual machine technology. There is a user group privilege vulnerabilit...
[20180505] - Core - XSS Vulnerabilities & additional hardening
Inadequate input filtering leads to multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack...
CVE-2014-4919
OXID eShop vulnerability CVE-2014-4919 affects multiple editions (Professional/Enterprise/Community) across several branches: remote attackers can assign users to arbitrary dynamical user groups via improper access control. Affected versions include Professional before 4.7.13 and 4.8.x before 4.8...
MODX Revolution CMS Cross-Site Scripting Vulnerability
MODX Revolution CMS is a new generation of Web2.0 open source content management system CMS of the U.S. company MODX. The system supports online collaboration , search engine optimization SEO, add-ons and so on. A cross-site scripting vulnerability exists in MODX Revolution CMS 2.5.6 and earlier...
CVE-2017-1000223
A stored web content injection vulnerability WCI, a.k.a XSS is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an...
CVE-2017-1000223: Improper Neutralization of Input During Web Page Generation
A stored web content injection vulnerability WCI, a.k.a XSS is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an...
PYSEC-2017-17
Multiple cross-site scripting XSS vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 first name or 2 last name user details, or the 3 repository, 4 repository group, or 5 user group description...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 first name or 2 last name user details, or the 3 repository, 4 repository group, or 5 user group description...
CVE-2015-1864
Multiple cross-site scripting XSS vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 first name or 2 last name user details, or the 3 repository, 4 repository group, or 5 user group description...
CVE-2015-1864
Multiple cross-site scripting XSS vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 first name or 2 last name user details, or the 3 repository, 4 repository group, or 5 user group description...
