Directory Traversal

ponse is vulnerable to directory traversal attacks. The library does not properly validate user input when fetching resources, allowing a malicious user to gain access to sensitive information by sending a http request...

CVE-2016-9484 PHP FormMail Generator generates PHP code for standard web forms, and the code generated does not properly validate user input folder directories and is vulnerable to path traversal

The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any P...

Security Bulletin: Cross-Site Scripting Vulnerability Affects IBM Emptoris Sourcing

Summary Cross-site scripting vulnerability in IBM Emptoris Sourcing could allow an attacker to execute script in a victim's Web browser Vulnerability Details IBM Emptoris Sourcing is vulnerable to cross-site scripting, caused by improper validation of user supplied input. A remote attacker could...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2016-0262)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2015-7451)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2015-7451 DESCRIPTION: IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplie...

Security Bulletin: IBM Forms Server vulnerability identified in Webform Server (CVE-2016-0223)

Summary IBM Forms Server's Webform Framework API is vulnerable to cross-site scripting when a specifically-crafted URL is used within the web browser. Vulnerability Details CVEID: CVE-2016-0223 DESCRIPTION: IBM Forms Server is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: Microsoft Windows MHTML Cross Site Scripting Alteration vulnerability in GDS component of IBM® InfoSphere® Master Data Management - Collaborative Edition (CVE-2014-0968)

Summary IBM® InfoSphere® Master Data Management - Collaborative Edition is vulnerable to cross-site scripting that is caused by improper validation of user-supplied input. A remote attacker can use a specially crafted URL to run scripts in a victim's web browser within the security context of the...

Security Bulletin: Cross-site scripting vulnerabilities in IBM Business Process Manager (BPM) Coach NG framework (CVE-2015-0158)

Summary IBM Business Process Manager Coach NG framework is vulnerable to cross-site scripting, which is caused by the improper validation of user-supplied input. A remote attacker might exploit this vulnerability using a specially crafted URL to execute a script in a user's web browser within the...

Security Bulletin: Cross-site scripting vulnerability in IBM Business Process Manager (BPM) Process Center (CVE-2015-0101)

Summary Insufficient user input validation in IBM Business Process Manager's Process Center can lead to a cross-site scripting exposure. Vulnerability Details CVEID: CVE-2015-0101 DESCRIPTION: IBM Business Process Manager Process Centeris vulnerable to cross-site scripting, caused by improper...

Security Bulletin: Cross-site scripting vulnerability in IBM Business Process Manager (BPM) Process Inspector (CVE-2014-6173)

Summary Insufficient user input validation in IBM Business Process Manager's Process Inspector can lead to a cross-site scripting exposure. Vulnerability Details CVE ID: CVE-2014-6173 CVSS Base Score: 3.5 CVSS Temporal Score: See for the current score CVSS Environmental Score: Undefined CVSS...

Cross site scripting

The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the...

CVE-2018-11688

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site,...

Design/Logic Flaw

SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 Java 7.30, 7.31, 7.40...

CVE-2018-1103

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command...

CVE-2018-1103

CVE-2018-1103 affects OpenShift Enterprise source-to-image prior to version 1.1.10, where an improper validation of user input enables an attacker to trick a user into copying files from a pod, potentially overwriting files outside the target directory during archive extraction (Zip Slip). Root c...

Windows Hyper-V Information Disclosure Vulnerability

An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker on a guest operating system could run a specially crafted application...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Unified Computing System UCS Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

Cisco UCS Director Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Computing System UCS Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

Cisco Registered Envelope Service Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the affected service. The vulnerability is due to...

Cisco Identity Services Engine Local Command Injection Vulnerability

A vulnerability in certain CLI commands of Cisco Identity Services Engine ISE could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user. These commands should have been restricted from this user. The vulnerability...