CVE-2015-5622

CVE-2015-5622 concerns the robustness of WordPress shortcode HTML tag filtering. The patch tightened the parsing in wp-includes/kses.php and related shortcode handling, with fixes released around WordPress 4.2.x and culminating in WordPress 4.2.3. Debian advisories also note fixes for this CVE in...

CVE-2015-3440

CVE-2015-3440 affects WordPress prior to 4.2.1 via an XSS in wp-includes/wp-db.php, where a long comment could be stored improperly due to MySQL TEXT type limitations. The Debian advisory notes that this is related to an incomplete fix for CVE-2015-3440 and references later revisions such as 4.2....

CVE-2015-2870

Cross-site scripting XSS vulnerability on Chiyu BF-630, BF-630W, and BF-660C fingerprint access-control devices allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element...

Cross site scripting

Cross-site scripting XSS vulnerability on Chiyu BF-630, BF-630W, and BF-660C fingerprint access-control devices allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted URL that leverages incomplete filtering of HTML elements, aka Bug ID CSCut41766...

Cross site scripting

Cross-site scripting XSS vulnerability in the management interface in Cisco Prime Central for Hosted Collaboration Solution PC4HCS 10.62 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuv45818...

CVE-2015-0732

Cross-site scripting XSS vulnerability in Cisco AsyncOS on the Web Security Appliance WSA 9.0.0-193; Email Security Appliance ESA 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance SMA 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML...

CVE-2015-3226

Cross-site scripting XSS vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Research Artisan Lite before 1.18 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted HTML document or 2 a crafted URL that is mishandled during access-log analysis...

CVE-2015-2976

Multiple cross-site scripting XSS vulnerabilities in Research Artisan Lite before 1.18 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted HTML document or 2 a crafted URL that is mishandled during access-log analysis...

CVE-2015-2976

CVE-2015-2976 affects Research Artisan Lite prior to 1.18. The provided documents confirm multiple cross-site scripting (XSS) vulnerabilities (CWE-79) that can allow remote attackers to inject arbitrary scripts via either a crafted HTML document or a crafted URL processed during access-log analys...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the uscesreferer parameter to 1 classes/usceshop.class.php, 2 includes/edit-form-advanced.php, 3 includes/edit-form-advanced30.php,...

CVE-2015-2973

Multiple cross-site scripting XSS vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the uscesreferer parameter to 1 classes/usceshop.class.php, 2 includes/edit-form-advanced.php, 3 includes/edit-form-advanced30.php,...

Cross site scripting

Cross-site scripting XSS vulnerability in org/chromium/chrome/browser/UrlUtilities.java in Google Chrome before 44.0.2403.89 on Android allows remote attackers to inject arbitrary web script or HTML via a crafted intent: URL, as demonstrated by a trailing alertdocument.cookie;// substring, aka...

CVE-2015-1286

Cross-site scripting XSS vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8contextnativehandler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context...

WordPress <= 4.2.2 - XSS

WordPress 4.2.2 is prone to a cross site scripting vulnerability that allows an authenticated user to bypass intended access restrictions and create drafts by leveraging the Subscriber role. Also, it allows to inject web script or HTML by leveraging the Author role to place a crafted shortcode...

CVE-2015-1286

Cross-site scripting XSS vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8contextnativehandler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context...

CVE-2015-1275

Google Chrome before 44.0.2403.89 on Android is vulnerable to UXSS via a crafted intent: URL, enabling remote attackers to inject arbitrary script or HTML (trailing alert(document.cookie);// substring) through UrlUtilities.java. This is CVE-2015-1275. OpenSUSE/GLSA and related advisories show the...

CVE-2014-0611

Multiple cross-site scripting XSS vulnerabilities in WebAccess in Novell GroupWise 2012 before Support Pack 4 and 2014 before Support Pack 2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-0611

Multiple cross-site scripting XSS vulnerabilities in WebAccess in Novell GroupWise 2012 before Support Pack 4 and 2014 before Support Pack 2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...