Cross-site Scripting (XSS)

sonata-project/admin-bundle is vulnerable to cross-site scripting XSS attacks. The library does not properly escape item.label in function templateResult in sonatatypemodelautocomplete.html.twig, allowing a malicious user to inject and execute arbitrary web scripts...

Cross-site Scripting (XSS)

paypal/merchant-sdk-php is vulnerable to cross-site scriptingXSS attacks. The vulnerability exists due to insufficient filtration of user-supplied data in token HTTP GET parameter in samples/AccountAuthentication/GetAuthDetails.html.php, allowing a malicious user to inject and execute arbitrary w...

Cross-site Scripting (XSS)

buefy is vulnerable to cross-site scriptingXSS attacks. The vulnerability exists in b-taginput in Autocomplete.vue the use of v-html when auto-complete is set to true, allowing a malicious user to inject and execute arbitrary web scripts...

PT-2020-4992

Name of the Vulnerable Software and Affected Versions КТС «Маяк» affected versions not specified Description The issue is related to the lack of input data sanitization in the web interface, which could allow a remote attacker to inject arbitrary web scripts or HTML code. Recommendations At the...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/index.php by adding a question mark ? followed by the payload...

Oracle Siebel Sales Cross-Site Scripting

A cross-site scripting vulnerability exists in Oracle Siebel Sales. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web scripts into the affected system...

NewStart CGSL MAIN 5.04 : mailman Vulnerability (NS-SA-2019-0008)

The remote NewStart CGSL host, running version MAIN 5.04, has mailman packages installed that are affected by a vulnerability: - A cross-site scripting XSS flaw was found in mailman. An attacker, able to trick the user into visiting a specific URL, can execute arbitrary web scripts on the user's...

CVE-2018-16248

b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request...

Cross site request forgery (csrf)

b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request...

CVE-2018-16248

b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request...

XSS Vulnerability in JEESNS Article Comments

JEESNS is an open source social management system developed on JAVA's enterprise-class platform. JEESNS article comments at the XSS vulnerability , an attacker can use the vulnerability to inject arbitrary Web script or HTML...

httpd: privilege escalation from modules scripts

A flaw was found in Apache where code executing in a less-privileged child process or thread could execute arbitrary code with the privilege of the parent process usually root. An attacker having access to run arbitrary scripts on the web server PHP, CGI etc could use this flaw to run code on the...

Cross site scripting

A reflected Cross-Site scripting XSS vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the Login Form...

CVE-2018-18692

CVE-2018-18692 is a reflected XSS vulnerability in SEMCO Semcosoft 5.3. The issue allows an attacker to inject arbitrary web scripts or HTML through the username parameter on the Login Form. Affected component: login form handling in Semcosoft 5.3; root cause: insufficient sanitization/escaping o...

Ubuntu: Security Advisory (USN-3463-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-3563-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

D-Link Central WiFiManager Cross-Site Scripting (CVE-2018-17441; CVE-2018-17443)

Multiple cross-site scripting vulnerabilities exist in D-Link Central WiFiManager Software Controller. Successful exploitation of the vulnerabilities would allow remote attackers to inject arbitrary web scripts into the affected system...

Moderate severity vulnerability that affects rails-html-sanitizer

Withdrawn, accidental duplicate publish. Cross-site scripting XSS vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class...

CVE-2018-16805

In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator...

CVE-2018-16805

In CVE-2018-16805, the affected software is b3log Solo 2.9.3. The vulnerability is a cross-site scripting (XSS) flaw on the Input page under Publish Articles, where an ID named linkAddress stored in the link JSON field can be exploited to inject arbitrary Web scripts or HTML via a crafted site na...