CVE-2018-10994: Improper Neutralization of Input During Web Page Generation

js/views/messageview.js in Open Whisper Signal aka Signal-Desktop before 1.10.1 allows XSS via a URL...

PT-2018-10232

Name of the Vulnerable Software and Affected Versions Open Whisper Signal aka Signal-Desktop versions prior to 1.10.1 Description The issue allows for XSS via a URL in the js/views/message view.js file. Recommendations For versions prior to 1.10.1, update to version 1.10.1 or later to resolve the...

CVE-2018-1000169

An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized attackers to confirm the existence of agents or views with an attacker-specified name by sending a CLI command to...

SRC-2018-0027 : Foxit Reader DataView Uninitialized Object Information Disclosure Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

PT-2018-18602

Name of the Vulnerable Software and Affected Versions Kontena versions prior to 1.5.0 Description The issue allows for XSS in the "kontena master login --remote" code display. This can be demonstrated by using the /codecode= endpoint in a URI. Recommendations For versions prior to 1.5.0, update t...

CVE-2018-7663

An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile resources/views/layouts/app.blade.php allows for server-side template injection of arbitrary JavaScript...

CVE-2018-7663: Improper Neutralization of Input During Web Page Generation

An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile resources/views/layouts/app.blade.php allows for server-side template injection of arbitrary JavaScript...

PT-2018-18194

Name of the Vulnerable Software and Affected Versions Voten.co versions prior to 2017-08-25 Description An issue was discovered in the bio field of a user profile, allowing for server-side template injection of arbitrary JavaScript due to an unescaped template literal in...

CVE-2018-6465

The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php...

Fedora 27 : drupal7-views (2017-25114a9d7f)

7.x-3.18 - 7.x-3.17 - Moderately Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-068 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Description of the security update for SharePoint Foundation 2013: January 9, 2018

Description of the security update for SharePoint Foundation 2013: January 9, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see...

PT-2017-14987

Name of the Vulnerable Software and Affected Versions esb-csv-import-export plugin versions through 1.1 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML via the cie type, cie import, cie update, or cie ignore parameter to the...

CentOS 7 : sssd (CESA-2017:3379)

An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Cross site scripting

Stored cross-site scripting XSS vulnerability in "geminabox" Gem in a Box before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb...

CVE-2017-16792

Stored cross-site scripting XSS vulnerability in "geminabox" Gem in a Box before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb...

CVE-2017-16792

Gem in a Box (geminabox) prior to version 0.13.10 is affected by a stored XSS vulnerability. An attacker can inject arbitrary script via the homepage field in a .gemspec, related to the views/gem.erb and views/index.erb templates. The CVE-2017-16792 entry is corroborated by multiple sources (incl...

CVE-2017-16792

Stored cross-site scripting XSS vulnerability in "geminabox" Gem in a Box before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb...

CVE-2017-16792

Stored cross-site scripting XSS vulnerability in "geminabox" Gem in a Box before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb...

PT-2017-14563

Name of the Vulnerable Software and Affected Versions geminabox versions prior to 0.13.10 Description A stored cross-site scripting XSS issue allows attackers to inject arbitrary web script via the homepage value of a .gemspec file. This is related to the views/gem.erb and views/index.erb files...

CVE-2017-16792: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS vulnerability in "geminabox" Gem in a Box before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb...