httpd: privilege escalation from modules scripts

A flaw was found in Apache where code executing in a less-privileged child process or thread could execute arbitrary code with the privilege of the parent process usually root. An attacker having access to run arbitrary scripts on the web server PHP, CGI etc could use this flaw to run code on the...

Cross site scripting

A reflected Cross-Site scripting XSS vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the Login Form...

CVE-2018-18692

CVE-2018-18692 is a reflected XSS vulnerability in SEMCO Semcosoft 5.3. The issue allows an attacker to inject arbitrary web scripts or HTML through the username parameter on the Login Form. Affected component: login form handling in Semcosoft 5.3; root cause: insufficient sanitization/escaping o...

Ubuntu: Security Advisory (USN-3563-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-3463-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

D-Link Central WiFiManager Cross-Site Scripting (CVE-2018-17441; CVE-2018-17443)

Multiple cross-site scripting vulnerabilities exist in D-Link Central WiFiManager Software Controller. Successful exploitation of the vulnerabilities would allow remote attackers to inject arbitrary web scripts into the affected system...

Moderate severity vulnerability that affects rails-html-sanitizer

Withdrawn, accidental duplicate publish. Cross-site scripting XSS vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class...

CVE-2018-16805

In CVE-2018-16805, the affected software is b3log Solo 2.9.3. The vulnerability is a cross-site scripting (XSS) flaw on the Input page under Publish Articles, where an ID named linkAddress stored in the link JSON field can be exploited to inject arbitrary Web scripts or HTML via a crafted site na...

CVE-2018-16805

In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator...

PHP Scripts Mall Website Seller Script Cross-Site Scripting Vulnerability

PHP Scripts Mall Website Seller Script is an e-commerce website system script from PHP Scripts Mall India. A cross-site scripting vulnerability exists in PHP Scripts Mall Website Seller Script version 2.0.5. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or...

Cross site scripting

SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting XSS vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This attack appear to be exploitable via the victim opening a specially crafted URL...

CVE-2018-1000611

SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting XSS vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This attack appear to be exploitable via the victim opening a specially crafted URL...

CVE-2018-1000611

SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting XSS vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This attack appear to be exploitable via the victim opening a specially crafted URL...

CVE-2018-12104

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...

CVE-2018-12104

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...

PYSEC-2018-116

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...

Cross site scripting

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...

CVE-2018-12104

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...

CVE-2018-12104

Airbnb Knowledge Repo 0.7.4 is reported vulnerable to Cross-site Scripting (XSS) via the post comments functionality (post/posts/new_report.kp). The root cause is improper input validation in the comments feature, as cited by Veracode (improper user input validation) and OSV entries noting the is...

Joomla! Component jDownloads Cross-Site Scripting Vulnerability

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds, site search and other functions . jDownloads is Joomla! A cross-site scripting vulnerability exists in Joomla! Component jDownloads. Allows remote attackers to...