Cross site scripting

A persistent cross-site scripting XSS vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML...

CVE-2012-5193

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 stats/index.php or 2 newsletters/edition.php or the 3 username parameter to users/remindpassword.php, 4 days parameter to...

CVE-2013-4275

Cross-site scripting XSS vulnerability in the zenbreadcrumb function in template.php in the Zen theme 6.x-1.x, 7.x-3.x before 7.x-3.2, and 7.x-5.x before 7.x-5.4 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the...

CVE-2012-5193

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 stats/index.php or 2 newsletters/edition.php or the 3 username parameter to users/remindpassword.php, 4 days parameter to...

CVE-2012-5193

Bitweaver 2.8.1 and earlier versions are affected by multiple cross-site scripting (XSS) vulnerabilities (CVE-2012-5193). Attackers can inject arbitrary web script or HTML by manipulating path info or specific parameters: stats/index.php (path info, days), newsletters/edition.php, users/remind_pa...

CVE-2012-2237

Summary: CVE-2012-2237 affects Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2, enabling remote XSS via multiple vectors (1) javascript innerHTML in login form generation, (2) links, (3) resources URLs, and (4) the Display name in profiles. The underlying issue is insufficient sanitization/encod...

CVE-2012-2237

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 javascript innerHTML as used when generating login forms, 2 links or 3 resources URLs, and 4 the Display nam...

Cross site scripting

An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the "Connected Clients" field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this...

Cross site scripting

An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the FileName parameter to /FTPDiag.asp...

CVE-2019-17523

CVE-2019-17523 and CVE-2019-17524 concern the same device family: Technicolor TC7300 STFA.51.20. The CVE-2019-17523 entry describes an XSS vulnerability that allows remote attackers to inject arbitrary web script via the FileName parameter to /FTPDiag.asp. The related CVE-2019-17524 entry describ...

CVE-2019-17524

An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the "Connected Clients" field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this...

CVE-2019-17524

CVE-2019-17524 describes an XSS vulnerability affecting Technicolor TC7300 STFA.51.20 devices. The issue stems from the web interface where an attacker can inject arbitrary script via the "Connected Clients" field to /wlanAccess.asp; an intranet host can exploit this with a crafted hostname. Mult...

CVE-2013-1426

Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...

CVE-2018-18674

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka the adm/boardformupdate.php bocontenttail parameter...

CVE-2013-1426

Affected software: Mahara. Vulnerable component: TinyMCE editor used in Mahara pages. Root cause: Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary script/HTML via the TinyMCE editor. Impact: potential remote code execution in the...

Jenkins build-metrics Plugin Cross-Site Scripting (CVE-2019-10475)

A cross-site scripting vulnerability exists in Jenkins build-metrics Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the effected system...

CVE-2011-4903

Cross-site Scripting XSS in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function...

CVE-2011-4632

Cross-site Scripting XSS in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message...

CVE-2011-4631

Cross-site Scripting XSS in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system extension recycler...

CVE-2011-4631

Cross-site Scripting XSS in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system extension recycler...