The ESXi Host Client in VMware ESXi (6.5 before ESXi650-201712103-SG 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker can exploit this vulnerability by injecting Javascript which might get executed when other users access the Host Client.


VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page.


EMC RSA Adaptive Authentication (On-Premise) versions prior to 7.3 P2 (exclusive) contains a fix for a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.


BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability was discovered in a legacy utility.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

esb-csv-import-export

plugin

through

for

WordPress

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

parameter

to


A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0 5.6.4 and below versions FortiAnalyzer 6.0.0 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature.


ServersCheck Monitoring Software before 14.2.3 is prone to a cross-site scripting vulnerability as user supplied-data is not validated/sanitized when passed in the settings_SMS_ALERT_TYPE parameter and JavaScript can be executed on settings-save.html (the Settings - SMS Alerts page).


In BlackBerry UEM Management Console version 12.7.1 and earlier a reflected cross-site scripting vulnerability that could allow an attacker to execute script commands in the context of the affected UEM Management Console account by crafting a malicious link and then persuading a user with legitimate access to the Management Console to click on the malicious link.


i18next is a language translation framework. When using the .init method passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped but is not. This vulnerability affects i18next 2.0.0 and later.


MapOS 3.1.11 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in /clientes/visualizar which allows remote attackers to inject arbitrary web script or HTML via a crafted description parameter.


A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3 2.4.x before 2.4.2 and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.


ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions if AngularJS is used in combination with ag-grid.


Cross-site scripting (XSS) vulnerability in Integration Matters nJAMS 3 before 3.2.0 Hotfix 7 as used in TIBCO BusinessWorks Process Monitor through 3.0.1.3 and other products allows remote authenticated administrators to inject arbitrary web script or HTML via the users management panel of the web interface.


An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the \return\ parameter of the \index.php?pg=moderated\ endpoint. It executes when the return link is clicked.


Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration from 7.10 to 7.11 7.20 7.30 7.31 7.40 7.50 due to insufficient encoding of user controlled inputs.


A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows remote attackers to inject arbitrary JavaScript in the nameFirst (aka First Name) field for the employee details page (/employee.html) that is then reflected in multiple pages where that field data is utilized resulting in session hijacking and possible elevation of privileges.


In version 3.5 and prior of Cambium Networks ePMP firmware all authenticated users have the ability to update the Device Name and System Description fields in the web administration console and those fields are vulnerable to persistent cross-site scripting (XSS) injection.


If a page is loaded from an original site through a hyperlink and contains a redirect to a \data:text/html\ URL triggering a reload will run the reloaded \data:text/html\ page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 52.1 and Firefox < 53.


Multiple cross-site scripting (XSS) vulnerabilities in ViMbAdmin 3.0.15 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) transport parameter to domain/add; the (3) name parameter to mailbox/add/did/<domain id>; the (4) goto parameter to alias/add/did/<domain id>; or the (5) captchatext parameter to auth/lost-password.


Cross-site scripting (XSS) vulnerability in the Management Web Interface in Palo Alto Networks PAN-OS 5.1 6.x before 6.1.16 7.0.x before 7.0.13 and 7.1.x before 7.1.8 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Input sent from a malicious client is not properly verified by the server. An attacker can execute arbitrary script code in another user's browser session (CROSS-SITE SCRIPTING).


Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field. An authenticated user with permissions to upload or send files can populate this field with a filename that contains standard HTML scripting tags. The resulting script will evaluated by any other authenticated user who views the attacker-supplied file name. All versions of SFT prior to 5.1.1028 are affected. The fix version is 5.1.1028.


A vulnerability in the report renderer component of TIBCO JasperReports Server TIBCO JasperReports Server Community Edition TIBCO JasperReports Server for ActiveMatrix BPM TIBCO JasperReports Library TIBCO JasperReports Library for ActiveMatrix BPM TIBCO Jaspersoft for AWS with Multi-Tenancy TIBCO Jaspersoft Reporting and Analytics for AWS TIBCO Jaspersoft Studio and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO JasperReports Server 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0 TIBCO JasperReports Server Community Edition 6.4.0 and below TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0 and below TIBCO JasperReports Library 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1 TIBCO JasperReports Library for ActiveMatrix BPM 6.4.1 and below TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0 and below TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 and below TIBCO Jaspersoft Studio 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0 and TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 and below.


Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the \Name\ and \Description\ fields of a Workspace as well as the \Description\ field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025.


Cross-site scripting (XSS) vulnerability in InterSect Alliance SNARE Epilog for UNIX version 1.5 allows remote authenticated users to inject arbitrary web script or HTML via the str_log_name parameter in a \Web Admin Portal > Log Configuration > Add\ action.


An issue was discovered in Schneider Electric homeLYnk Controller LSS100100 all versions prior to V1.5.0. The homeLYnk controller is susceptible to a cross-site scripting attack. User inputs can be manipulated to cause execution of JavaScript code.


Cross-site

scripting

(XSS)

vulnerability

in

the

theme-name

fallback

functionality

in

wp-includes/class-wp-theme.php

in

WordPress

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

directory

name

of

a

theme

related

to


A Remote Cross-Site Scripting (XSS) vulnerability in HPE Operations Bridge Analytics version v3.0 was found.


Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionality allows attackers to inject arbitrary web scripts and execute malicious scripts within an authenticated client's browser.


Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id parameter to tree.php and drp_action parameter to data_sources.php.


The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting (XSS) vulnerabilities affecting version 5.0.0 and prior versions. These vulnerabilities could allow remote authenticated attackers to inject arbitrary web script or HTML.


The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view.


I Librarian version <=4.6 & 4.7 is vulnerable to Reflected Cross-Site Scripting in the temp.php resulting in an attacker being able to inject malicious client side scripting which will be executed in the browser of users if they visit the manipulated site.


Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.


Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability within the page creation page which can result in disruption of service and execution of javascript code.


Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users.


The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk it was transmitted in plain text as part of the configuration form. This could result in exposure of the API key for example through browser extensions or cross-site scripting vulnerabilities. The Datadog Plugin now encrypts the API key transmitted to administrators viewing the global configuration form.


Jenkins

Build-Publisher

plugin

version

and

earlier

stores

credentials

to

other

Jenkins

instances

in

the

file

hudson.plugins.build_publisher.BuildPublisher.xml

in

the

Jenkins

master

home

directory.

These

credentials

were

stored

unencrypted

allowing

anyone

with

local

file

system

access

to

access

them.

Additionally

the

credentials

were

also

transmitted

in

plain

text

as

part

of

the

configuration

form.

This

could

result

in

exposure

of

the

credentials

through

browser

extensions

cross-site

scripting

vulnerabilities

and

similar

situations.


LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability within the blog creation page which can result in disruption of service and execution of javascript code.


Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability within the edit blog post page which can result in disruption of service and execution of javascript code.


The Details view of some Static Analysis Utilities based plugins was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to these plugins for example the console output which is parsed to extract build warnings (Warnings Plugin) could insert arbitrary HTML into this view.


The custom Details view of the Static Analysis Utilities based DRY Plugin was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view.


Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the \Administrators\ or \Content Administrators\ role.


Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability within the invoice creation page which can result in disruption of service and execution of javascript code.


The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript resulting in a cross-site scripting vulnerability through specially crafted URLs.


BookStack version 0.18.4 is vulnerable to stored cross-site scripting within the page creation page which can result in disruption of service and execution of javascript code.


Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.


The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser.


The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard leading to a Reflected Cross-Site Scripting


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Kodak

InSite

to

allow

remote

attackers

to

inject

arbitrary

web

script

via

the

\paramFile\

parameter

to

or

\paramFile\

parameter

to


The

Agenda

component

in

Telaxus

EPESI

and

earlier

has

a

Stored

Cross-site

Scripting

(XSS)

vulnerability

in

which

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

meeting

description

parameter.


Cross-site

scripting

(XSS)

vulnerability

in

ProjectSend

(formerly

cFTP)

before

commit

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

Description

field

in

My

account

Name

updated

related

to

home.php

and

actions-log.php.


Telaxus EPESI 1.8.2 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in modules/Base/Dashboard/Dashboard_0.php which allows remote attackers to inject arbitrary web script or HTML via a crafted tab_name parameter.


Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated users to inject arbitrary web script or HTML persistently by uploading a crafted HTML file. The attack vector is the content of this file and the filename must be specified in the PATH_INFO to readfile.php.


Cross-site

scripting

(XSS)

vulnerabilities

in

BigTree

CMS

through

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

description

parameter.

This

issue

exists

in

and

Low-privileged

(administrator)

users

can

attack

high-privileged

(Developer)

users.


Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter) core/ajax/box.php (PATH_INFO) product/stats/card.php (type parameter) holiday/list.php (month_create month_start and month_end parameters) and don/card.php (societe lastname firstname address zipcode town and email parameters).


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Trend

Micro

ServerProtect

for

Linux

before

CP

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

textarea

or

tmLastConfigFileModifiedDate

parameter

to

notification.cgi.


All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into ClearPass in the same browser.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Quali

CloudShell

before

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

Name

or

Description

parameter

to

RM/Reservation/ReserveNew;

the

Description

parameter

to

RM/Topology/Update;

the

Name

Description

or

Labels

parameter

to

SnQ/JobTemplate/Edit;

or

Alias

or

Description

parameter

to

RM/AbstractTemplate/AddOrUpdateAbstractTemplate.


A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2 PI Integrator for Microsoft Azure before 2016 R2 SP1 and PI Integrator for SAP HANA before 2017. An attacker may be able to upload a malicious script that attempts to redirect users to a malicious web site.


DISPUTED

Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

BigTree

CMS

through

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

by

uploading

a

crafted

package

triggering

mishandling

of

the

title

or

version

or

parameter

in

manifest.json.

This

issue

exists

in

and

NOTE:

the

vendor

states

\You

must

implicitly

trust

any

package

or

extension

you

install

as

they

all

have

the

ability

to

write

PHP

files.\


admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability which allows remote authenticated users to inject arbitrary web script or HTML by launching an Edit Page action and entering the Navigation Title or Page Title of a page that is scheduled for future publication (aka a pending page change).


Cross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18 7.x before 7.0.16 7.1.x before 7.1.11 and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi the referers parameter to change_referers.cgi or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.


Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.


admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability which allows remote authenticated users to inject arbitrary web script or HTML by launching a Home Template Edit Page action and entering the Navigation Title of a page that is scheduled for future publication (aka a pending page change).


Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18 7.x before 7.0.16 7.1.x before 7.1.11 and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting (XSS).


An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In this case user's credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user's browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file's response and displays it inside a Textfield.


EMC Network Configuration Manager (NCM) 9.3.x 9.4.0.x 9.4.1.x and 9.4.2.x is affected by a reflected cross-site scripting Vulnerability that could potentially be exploited by malicious users to compromise the affected system.


An issue was discovered on Securifi Almond Almond+ and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking IP addresses using the web management interface. It seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site scripting payload on the user's browser and execute any action on the device provided by the web management interface.


Microsoft SharePoint Server 2010 Service Pack 2 allows a cross-site scripting (XSS) vulnerability when it does not properly sanitize a specially crafted web request to an affected SharePoint server aka \Microsoft Office SharePoint XSS Vulnerability\.


Starting in version 5.3.0 Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.


HedEx Earlier than V200R006C00 versions have the stored cross-site scripting (XSS) vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users.


RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Questionnaire ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.


Huawei Email APP Vicky-AL00 smartphones with software of earlier than VKY-AL00C00B171 versions has a stored cross-site scripting vulnerability. A remote attacker could exploit this vulnerability to send email that storing malicious code to a smartphone and waiting for a user to access this email that triggers execution of the code. An exploit could allow the attacker to execute arbitrary script code on the affected device.


An issue was discovered on Securifi Almond Almond+ and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking key words passing in the web traffic to prevent kids from watching content that might be deemed unsafe using the web management interface. It seems that the device does not implement any cross-site scripting protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a stored cross-site scripting payload on the user's browser and execute any action on the device provided by the web management interface.


EMC Isilon OneFS (versions prior to 8.1.0.1 versions prior to 8.0.1.2 versions prior to 8.0.0.6 version 7.2.1.x) is impacted by a reflected cross-site scripting vulnerability that may potentially be exploited by malicious users to compromise the affected system.


A Remote Cross-Site Scripting (XSS) vulnerability in HPE LoadRunner v12.53 and earlier and HPE Performance Center version v12.53 and earlier was found.


A Remote Cross-Site Scripting vulnerability in HPE Project and Portfolio Management (PPM) version v9.30 v9.31 v9.32 v9.40 was found.


The EMC RSA Identity Governance and Lifecycle RSA Via Lifecycle and Governance and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1 7.0.2 all patch levels; RSA Via Lifecycle and Governance version 7.0 all patch levels; RSA Identity Management and Governance (RSA IMG) versions 6.9.1 all patch levels) are affected by multiple stored cross-site scripting vulnerabilities. Remote authenticated malicious users could potentially inject arbitrary HTML code to the application.


Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board IPB or Power Board) 4.x before 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the event_locationaddress array parameter to calendar/submit/.


Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10 1.24.x before 1.24.3 and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the rel404 parameter which is not properly handled in an error page.


Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) entity title related to in-place editing or a (2) node title.


Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via a (1) section_* (2) template_* (3) label_* or (4) new_template parameter to Special:CreateForm or (5) target or (6) alt_form parameter to Special:FormEdit.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

pfSense

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

srctrack

or

parameter

to

the

port

snaplen

or

count

parameter

to

the

or

parameter

to

interfaces.php;

the

or

parameter

to

the

member

parameter

to

the

port

or

retry

parameter

to

the

pkgrepourl

parameter

to

the

zone

parameter

to

the

port

parameter

to

or

the

or

parameter

to

the

sshport

parameter

to

the

id

tunable

descr

or

value

parameter

to

the

firmwareurl

repositoryurl

or

branch

parameter

to

the

pfsyncpeerip

synchronizetoip

username

or

passwordfld

parameter

to

the

maxmss

parameter

to

the

or

parameter

to

or

unspecified

parameters

to

or


Microsoft Internet Explorer 8 through 11 mishandles HTML attributes in HTTP responses which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors aka \Internet Explorer XSS Filter Bypass Vulnerability.\


Microsoft Edge mishandles HTML attributes in HTTP responses which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors aka \Microsoft Edge XSS Filter Bypass.\


Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username (2) admin_password (3) admin_email (4) dbserver (5) dbname (6) dbuser (7) dbpass (8) table_prefix or (9) impath parameter.


Microsoft Edge mishandles HTML attributes in HTTP responses which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors aka \Microsoft Edge XSS Filter Bypass Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php; (2) adaptiveend (3) adaptivestart (4) maximumstates (5) maximumtableentries or (6) aliasesresolveinterval parameter to system_advanced_firewall.php; (7) proxyurl (8) proxyuser or (9) proxyport parameter to system_advanced_misc.php; or (10) name (11) notification_name (12) ipaddress (13) password (14) smtpipaddress (15) smtpport (16) smtpfromaddress (17) smtpnotifyemailaddress (18) smtpusername or (19) smtppassword parameter to system_advanced_notifications.php.


Cross-site scripting (XSS) vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal when the search index is configured to use the HTML filter processor allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors which are not properly handled in the returned suggestions.


Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10 1.24.x before 1.24.3 and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter which is not properly handled in an error page related to \ForeignAPI images.\


Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cfgprojectName parameter to index.php/admin/saveConfig the (2) datastats_provider_url parameter to index.php/areas/saveArea or the (3) datadescription parameter to index.php/areas/saveSection.


Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1 Office Web Apps 2010 SP2 Excel Web App 2010 SP2 Office Web Apps Server 2013 SP1 and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL aka \Microsoft Office Web Apps XSS Spoofing Vulnerability.\


Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element possibly related to the \a\ tag.


Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to inject arbitrary web script or HTML via a crafted value aka Bug ID CSCux10614.


Cross-site scripting (XSS) vulnerability in the \Create download task via URL\ feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an add_url_task action to dlm/downloadman.cgi.


Cross-site scripting (XSS) vulnerability in contrib/cssgen.php in the GeSHi as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10 1.24.x before 1.24.3 and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.4 6.1.x before 6.1.8 6.0.x before 6.0.9 and 5.0.x before 5.0.13 and Splunk Light 6.2.x before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via a header.


Cross-site scripting (XSS) vulnerability in Microsoft Excel for Mac 2011 and Excel 2016 for Mac allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message that is mishandled by Outlook for Mac aka \Microsoft Outlook for Mac Spoofing Vulnerability.\


Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0.10 allows remote attackers to inject arbitrary web script or HTML via a crafted hostname in an SNMP response aka Bug ID CSCuw47238.


Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via crafted content in an Office Marketplace instance aka \Microsoft SharePoint Security Feature Bypass Vulnerability.\


Cross-site scripting (XSS) vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the \administer mass contact\ permission to inject arbitrary web script or HTML via a category label.


Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to inject arbitrary web script or HTML via the (1) errorNo or (2) errorMsg parameter to error.php; the (3) viewType parameter to duplicate_manager.php; the (4) queryAction (5) displayType (6) citeOrder (7) sqlQuery (8) showQuery (9) showLinks (10) showRows or (11) queryID parameter to query_manager.php; the (12) sourceText or (13) sourceIDs parameter to import.php; or the (14) typeName or (15) fileName parameter to modify.php.


Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) wpSummary parameter to Special:FormEdit the (2) \Template label (optional)\ field in a form or a (3) Field name in a template.


Cross-site scripting (XSS) vulnerability in the \Create download task via file upload\ feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file.


Cross-site scripting (XSS) vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the \Administer Path Breadcrumbs\ permission to inject arbitrary web script or HTML via unspecified vectors.


Microsoft Internet Explorer 9 through 11 improperly implements a cross-site scripting (XSS) protection mechanism which allows remote attackers to bypass the Same Origin Policy via a crafted web site aka \Internet Explorer XSS Filter Bypass Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in the Time Tracker module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) note added to a time entry or an (2) activity used to categorize time tracker entries.


Multiple cross-site scripting (XSS) vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to inject arbitrary web script or HTML via (1) an SNMP OID object (2) an SNMP trap message (3) the View Names field (4) the Group Names field (5) the Flow Monitor Credentials field (6) the Flow Monitor Threshold Name field (7) the Task Library Name field (8) the Task Library Description field (9) the Policy Library Name field (10) the Policy Library Description field (11) the Template Library Name field (12) the Template Library Description field (13) the System Script Library Name field (14) the System Script Library Description field or (15) the CLI Settings Library Description field.


Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) ga_adsense (2) ga_admin_disable_DimentionIndex (3) ga_downloads_prefix (4) ga_downloads or (5) ga_outbound_prefix parameter in the google-analyticator page to wp-admin/admin.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Ignite

Realtime

Openfire

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

groupchatName

parameter

to

the

urlName

parameter

to

the

hostname

parameter

to

server-session-details.jsp;

or

the

search

parameter

to

group-summary.jsp.


Cross-site scripting (XSS) vulnerability in the Diagnosis Ping feature in the administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote attackers to inject arbitrary web script or HTML via an unspecified field.


Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart aka \Microsoft SharePoint Security Feature Bypass \ a different vulnerability than CVE-2016-0011.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Nokia

Networks

(formerly

Nokia

Solutions

and

Networks

and

Nokia

Siemens

Networks)

@vantage

Commander

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

idFilter

or

nameFilter

parameter

to

the

flName

parameter

to

the

serchStatus

refreshTime

or

serchNode

parameter

to

the

MaxActivationTime

NumberOfBytes

NumberOfTracefiles

SessionName

or

serchSessionkind

parameter

to

the

serchSessionDescription

parameter

to

the

serchApplication

or

serchApplicationkind

parameter

to

the

columKeyUnique

columParameter

componentName

description

filter

id

pathName

tableName

or

component

parameter

to

or

the

userid

parameter

to


Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors aka \Microsoft Browser XSS Filter Bypass Vulnerability.\


Cross-site scripting (XSS) vulnerability in the Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 132.8 10.5 before Build 57.7 and 10.5e before Build 56.1505.e allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401 BMXNOE0100 BMXNOE0110 BMXNOE0110H BMXNOR0200H BMXP342020 BMXP342020H BMXP342030 BMXP3420302 BMXP3420302H or BMXP342030H PLC client browser.


Cross-site scripting (XSS) vulnerability in the Compass Rose module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to \embedding a JavaScript library from an external source that was not reliable.\


The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges and possibly obtain sensitive information or conduct cross-site scripting (XSS) attacks via a crafted web site.


Cross-site

scripting

(XSS)

vulnerability

in

IBM

Rational

Collaborative

Lifecycle

Management

(CLM)

before

Interim

Fix

before

before

and

before

Rational

Quality

Manager

(RQM)

before

Interim

Fix

before

before

and

before

Rational

Team

Concert

(RTC)

before

Interim

Fix

before

before

and

before

Rational

Requirements

Composer

(RRC)

before

Interim

Fix

and

before

Rational

DOORS

Next

Generation

(RDNG)

before

before

and

before

Rational

Engineering

Lifecycle

Manager

(RELM)

and

before

before

and

before

Rational

Rhapsody

Design

Manager

(Rhapsody

DM)

before

before

and

before

and

Rational

Software

Architect

Design

Manager

(RSA

DM)

before

before

and

before

allows

remote

authenticated

users

with

project

administrator

privileges

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

project.

IBM

X-Force

ID:


Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2015-7795 CVE-2015-7797 CVE-2015-7798 CVE-2016-1149 and CVE-2016-1150.


Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge through 2015-04-28 allow remote attackers to inject arbitrary web script or HTML via the (1) adminUserName (2) pathToMYSQL (3) databaseStructureFile or (4) pathToBibutils parameter to install.php or the (5) adminUserName parameter to update.php.


Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to inject arbitrary web script or HTML via the username aka SAP Security Note 2153898.


Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15 6.x before 6.22.0 and 7.x before 7.2.0 allow remote attackers to inject arbitrary web script or HTML via a crafted \value\ attribute in a <input> element.


The Add-on SDK in Mozilla Firefox before 42.0 misinterprets a \script: false\ panel setting which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via inline JavaScript code that is executed within a third-party extension.


Cross-site scripting (XSS) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A TG862A and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to inject arbitrary web script or HTML via the pwd parameter.


Cross-site scripting (XSS) vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal when the OSF Ontology module is enabled allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.9 IF2 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 IF2 7.5.1 and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the runtime engine in the Newphoria applican framework before 1.13.0 for Android and iOS allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers WebView anchor attachment in an applican application a different vulnerability than CVE-2015-7771.


Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters (2) smart class parameters or (3) smart variables in the (a) host or (b) hostgroup edit forms.


Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3 in hardware models with a hard disk and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters.


Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1 10.1 11.0 11.3 and 11.4 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 107771.


Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) img or (2) url tag of a new comment.


Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) Media Title or (2) Media Subtitle fields.


Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2015-7795 CVE-2015-7796 CVE-2015-7798 CVE-2016-1149 and CVE-2016-1150.


Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

cpabc_appointments_admin_int_bookings_list.inc.php

in

the

Appointment

Booking

Calendar

plugin

before

for

WordPress

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors.


Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 4.0 before 4.0.7 iFix10 5.0 before 5.0.2 iFix15 and 6.0 before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108626.


Cross-site scripting (XSS) vulnerability in Jazz Foundation in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 4.0 before 4.0.7 iFix10 5.0 before 5.0.2 iFix15 and 6.0 before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108501.


Cross-site

scripting

(XSS)

vulnerability

in

IBM

Rational

Collaborative

Lifecycle

Management

(CLM)

before

Interim

Fix

before

before

and

before

Rational

Quality

Manager

(RQM)

before

Interim

Fix

before

before

and

before

Rational

Team

Concert

(RTC)

before

Interim

Fix

before

before

and

before

Rational

Requirements

Composer

(RRC)

before

Interim

Fix

and

before

Rational

DOORS

Next

Generation

(RDNG)

before

before

and

before

Rational

Engineering

Lifecycle

Manager

(RELM)

and

before

before

and

before

Rational

Rhapsody

Design

Manager

(Rhapsody

DM)

before

before

and

before

and

Rational

Software

Architect

Design

Manager

(RSA

DM)

before

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors.

IBM

X-Force

ID:


Cross-site scripting (XSS) vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.0 in Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via taxonomy vocabulary and term names.


Ipswitch MOVEit File Transfer (formerly DMZ) 8.1 and earlier when configured to support file view on download allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading HTML files.


Multiple cross-site scripting (XSS) vulnerabilities in the Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9 10.5 before Build 58.11 and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2015-7796 CVE-2015-7797 CVE-2015-7798 CVE-2016-1149 and CVE-2016-1150.


Cross-site scripting (XSS) vulnerability in InfoSphere Data Architect (IDA) as distributed in IBM Rational Software Architect 8.5 through 9.5 Rational Software Architect for WebSphere Software (RSA4WS) 8.5 through 9.5 and Rational Software Architect RealTime (RSART) 8.5 through 9.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to api/v3/public/shares/downloads/ the (2) authType parameter to api/v3/auth/login or the (3) login parameter to api/v3/auth/reset_password.


Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 9.1 10.1 11.0 before 11.0.0.0 IF11 11.3 before 11.3.0.0 IF7 and 11.4 before 11.4.0.4 IF1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.


Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5 10.0.2.x before 10.0.2.7 iFix4 and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin and conduct cross-site scripting (XSS) attacks by appending whitespace characters to an IP address string.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Kentico

CMS

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

parameter

name

to

or

the

CMSBodyClass

cookie

variable

to

the

default

URI.


Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 4.0 before 4.0.7 iFix10 5.0 before 5.0.2 iFix15 and 6.0 before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108633.


Mozilla Firefox before 42.0 on Android improperly restricts URL strings in intents which allows attackers to conduct cross-site scripting (XSS) attacks via vectors involving an intent: URL and fallback navigation aka \Universal XSS (UXSS).\


Multiple cross-site scripting (XSS) vulnerabilities in open-flash-chart.swf in Open Flash Chart 2 as used in the VideoAds plugin in Revive Adserver before 3.2.2 and CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227 5.5.1 before 5.5.1-1616 5.5.2 before 5.5.2-434 and 6.1.0 before 6.1.0-1026 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) data-file parameter.


Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter.


Cross-site scripting (XSS) vulnerability in Reference Data Management (RDM) in IBM InfoSphere Master Data Management 10.1 11.0 before FP5 11.3 11.4 and 11.5 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site

scripting

(XSS)

vulnerability

in

Ember.js

through

before

before

before

before

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML.


Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allows remote authenticated users to inject arbitrary web script or HTML via the role name aka SAP Security Note 2153898.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

TestLink

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

parameter

to

the

containerType

parameter

to

the

or

parameter

to

the

useRecursion

parameter

to

the

targetTestCase

or

parameter

to

or

the

HTTP

Referer

header

to


Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page.


Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2015-7795 CVE-2015-7796 CVE-2015-7797 CVE-2016-1149 and CVE-2016-1150.


Cross-site scripting (XSS) vulnerability in the runtime engine in the Newphoria applican framework before 1.13.0 for Android and iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID that is encountered by an applican application a different vulnerability than CVE-2015-7772.


Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) serial parameter to alerts/summary/profile/; the (2) urlForCreatingReport parameter to csearch/report/export/; the (3) id parameter to analysis/detail/download/screenshot; or vectors related to (4) \Fortiview threats by users search filtered by vdom\ or (5) \PCAP file download generated by the VM scan feature.\


Cross-site scripting (XSS) vulnerability in Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the save_order function in class-floating-social-bar.php in the Floating Social Bar plugin before 1.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the items parameter in an fsb_save_order action to wp-admin/admin-ajax.php.


Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting (XSS) attacks.


Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) add.ctp (2) edit.ctp and (3) ajaxification.js.


Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element related to wp-includes/kses.php and wp-includes/shortcodes.php.


Cross-site scripting (XSS) vulnerability in the MailChimp Signup submodule in the MailChimp module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the \administer mailchimp\ permission to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in MySql Lite Administrator (mysql-lite-administrator) beta-1 allow remote attackers to inject arbitrary web script or HTML via the table_name parameter to (1) tabella.php (2) coloni.php or (3) insert.php or (4) num_row parameter to coloni.php.


The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message template which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via an HTTP response.


Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account which is not properly handled when deleting an account.


Cross-site

scripting

(XSS)

vulnerability

in

the

getWindowOpenJavaScript

function

in

org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow

in

Apache

Wicket

before

before

and

before

might

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

ModalWindow

title.


Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the \error\ parameter to wp-admin/edit.php.


Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3 4.0 before CR4 4.5 before CR5 and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2015-5035.


Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.


Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do.


Multiple cross-site scripting (XSS) vulnerabilities in PHP scripts in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors as demonstrated an attack against admin_messages.php.


Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11 2.7.x before 2.7.10 2.8.x before 2.8.8 and 2.9.x before 2.9.2 allows remote authenticated users to inject arbitrary web script or HTML via a modified grouping description.


Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to dashboard/settings/categories/ (2) title or (3) rel parameter to dashboard/settings/links/ or (4) url parameter to dashboard/tools/pingservers/.


The

function

in

Zenphoto

before

does

not

properly

sanitize

HTML

tags

which

allows

remote

attackers

to

perform

a

cross-site

scripting

(XSS)

attack

by

wrapping

a

payload

in

\<<script></script>script>payload<script></script></script>\

or

in

an

image

tag

with

the

payload

as

the

onerror

event.


Cross-site scripting (XSS) vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x before 7.x-1.3 for Drupal allows remote authenticated users with the \view meta information\ permission to inject arbitrary web script or HTML via unspecified vectors related to the meta access tab.


Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the (1) query parameter in the run_query_editor_query module to CustomReportHandler.do (2) compAcct parameter to jsp/ResetADPwd.jsp or (3) redirectTo parameter to jsp/CacheScreenWidth.jsp.


DISPUTED

The

default

configuration

of

the

Jinja

templating

engine

used

in

the

Identity

Provider

(IdP)

server

in

Ipsilon

before

does

not

enable

auto-escaping

which

makes

it

easier

for

remote

attackers

to

conduct

cross-site

scripting

(XSS)

attacks

via

template

variables.

NOTE:

This

may

be

a

duplicate

of

Moreover

the

Jinja

development

team

does

not

enable

auto-escape

by

default

for

performance

issues

as

explained

in


Cross-site scripting (XSS) vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8 6.22.9 before 6.22.9-rev15m 7.x before 7.6.1-rev25 and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to object properties.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through FP11 6.0 Feature Pack 4 7.0 through FP9 7.0 Feature Pack 5 through 8 and 8.0 before 8.0.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a \ (double quote) character in a filename in a shared folder.


Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11 2.7.x before 2.7.11 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

version

parameter

in

the

importId

parameter

in

the

bc

fg

bgc

or

font

parameter

in

the

Services*

parameter

in

the

file

parameter

in

the

parameter

in

the

id

parameter

in

or

the

lastEventId

parameter

to

index.php/profile/getEvents.


The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15 7.x before 7.4.0 4.5.40 and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.


Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php (2) memberslist.php or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through FP11 6.0 Feature Pack 4 7.0 through FP9 7.0 Feature Pack 5 through 8 and 8.0 before 8.0.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Moodle through 2.6.11 2.7.x before 2.7.11 2.8.x before 2.8.9 and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.


Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to inject arbitrary web script or HTML via the ssid parameter.


The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation which might allow remote attackers to perform a cross-site scripting (XSS) via a crafted string.


Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) content or (2) title field in an add action in the posts page to index.php or the (3) q parameter in the posts page to index.php.


Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3 4.0 before CR4 4.5 before CR5 and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2015-5036.


Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the client_action parameter in a revslider_ajax_action action to wp-admin/admin-ajax.php.


Cross-site scripting (XSS) vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupal allows remote authenticated users with the \Administer blocks\ permission to inject arbitrary web script or HTML via unspecified vectors related to a login link.


Cross-site scripting (XSS) vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the \Administer own invoices\ permission to inject arbitrary web script or HTML via unspecified vectors involving nodes of the \Invoice\ content type.


Multiple cross-site scripting (XSS) vulnerabilities in the Registration codes module before 6.x-1.6 6.x-2.x before 6.x-2.8 and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with permission to create or edit taxonomy terms or nodes to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the (1) success parameter to login.php or (2) crafted URL parameters to index.php as demonstrated by the t parameter to photo/.


Multiple cross-site scripting (XSS) vulnerabilities in the ccmivr page in Cisco Unified Communications Manager (formerly CallManager) 10.5(2.10000.5) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter aka Bug ID CSCut19580.


Multiple cross-site scripting (XSS) vulnerabilities in Opsview 4.6.2 and earlier allow remote attackers to inject arbitrary web script or HTML via a (1) crafted check plugin the (2) description in a host profile or the (3) plugin_args parameter to a Test service check page.


Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Imagefield Info module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the \Administer image styles\ permission to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.23 7.x-3.x before 7.x-3.23 and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient (To) address of an email.


Cross-site

scripting

(XSS)

vulnerability

in

the

plugin

before

for

WordPress

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

address

parameter

as

demonstrated

by

a

request

to

index.php/2015/05/21/church_admin-registration-form/.


Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmation step for vector 2.


Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 12.1.3 12.2.3 and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Single Signon. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is a cross-site scripting (XSS) vulnerability which allows remote attackers to inject arbitrary web script or HTML via the Domain parameter in the CfgOCIReturn servlet.


Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the collection_description parameter to upload/manage_collections.php in an add_new action or the (2) photo_description (3) photo_tags or (4) photo_title parameter to upload/actions/photo_uploader.php.


Cross-site scripting (XSS) vulnerability in the Current Search Links module 7.x-1.x before 7.x-1.1 for Drupal when the \Append the keywords passed by the user to the list\ option is disabled allows remote attackers to inject arbitrary web script or HTML via a crafted search query.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0.0 through 7.0.0.2 CF29 8.0.0 before 8.0.0.1 CF19 and 8.5.0 before CF08 allows remote attackers to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2015-4998.


Cross-site scripting (XSS) vulnerability in the Trick Question module before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the \Administer Trick Question\ permission to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms.


Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4_iFix3 10.0.2.x before 10.0.2.7_iFix1 10.0.3.x before 10.0.3.2 and 10.0.4.x before 10.0.4.0_iFix1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.


Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Koha

before

before

before

and

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

tag

parameter

to

opac-search.pl;

the

value

parameter

to

authorities/authorities-home.pl;

the

delay

parameter

to

acqui/lateorders.pl;

the

authtypecode

or

tagfield

to

the

tagfield

parameter

to

the

limit

parameter

to

catalogue/search.pl;

the

or

parameter

to

serials/serials-search.pl;

or

the

author

collectiontitle

copyrightdate

isbn

publishercode

or

parameter

to

suggestion/suggestion.pl;

or

the

direction

display

or

addshelf

parameter

to

opac-shelves.pl.


Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 8.5.0 through 8.5.0.1 8.5.5 through 8.5.5.0 and 8.5.6 before 8.5.6.0 CF1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist which makes it easier for remote attackers to bypass the Content Security Policy (CSP) protection mechanism and conduct cross-site scripting (XSS) attacks via vectors involving SVG animations and the about:reader URL.


Cross-site scripting (XSS) vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted URL that leverages incomplete filtering of HTML elements aka Bug ID CSCut41766.


Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter. NOTE: this may overlap CVE-2015-4413.


Cross-site scripting (XSS) vulnerability in the Simple Subscription module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the \administer blocks\ permission to inject arbitrary web script or HTML via vectors related to block content.


Cross-site

scripting

(XSS)

vulnerability

in

in

the

Landing

Pages

plugin

before

for

WordPress

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

post

parameter

to

wp-admin/post-new.php.


Multiple cross-site scripting (XSS) vulnerabilities in Test/WorkArea/workarea.aspx in Ektron Content Management System (CMS) before 9.10 SP1 (Build 9.1.0.184.1.114) allow remote authenticated users to inject arbitrary web script or HTML via the (1) page (2) action (3) folder_id or (4) LangType parameter.


Multiple cross-site scripting (XSS) vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary web script or HTML via unknown vectors involving creating or editing (1) comments (2) taxonomy terms or (3) nodes.


Cross-site scripting (XSS) vulnerability in the SMS Framework module 6.x-1.x before 6.x-1.1 for Drupal when the \Send to phone\ submodule is enabled allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to message previews.


Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with the \create petition\ permission to inject arbitrary web script or HTML via unknown vectors.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13 7.5.0 before 7.5.0.8 IFIX003 and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX003 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in IBM Emptoris Strategic Supply Management Platform and Emptoris Program Management 10.x before 10.0.1.4_iFix3 10.0.2.x before 10.0.2.7_iFix1 10.0.3.x before 10.0.3.2 and 10.0.4.x before 10.0.4.0_iFix1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.5 and 6.0.0 allow remote attackers to inject arbitrary web script or HTML via a crafted URL aka Bug IDs CSCuv22557 CSCuv22583 CSCuv22632 CSCuv22641 CSCuv22650 CSCuv22662 CSCuv22697 and CSCuv22702.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0.0 through 7.0.0.2 CF29 8.0.0 before 8.0.0.1 CF19 and 8.5.0 before CF08 allows remote attackers to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2015-4993.


Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter.


Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Password Policy module 6.x-1.x before 6.x-1.11 and 7.x-1.x before 7.x-1.11 for Drupal when a site has a policy that uses the username constraint allows remote attackers to inject arbitrary web script or HTML via a crafted username that is imported from an external source.


Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request aka Bug ID CSCus16052.


Cross-site scripting (XSS) vulnerability in the Profile2 Privacy module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the \Administer Profile2 Privacy Levels\ permission to inject arbitrary web script or HTML via unspecified vectors.


The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob data and filesystem URL schemes during wildcard source-expression matching which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior.


Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.22 7.x-3.x before 7.x-3.22 and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title which is used as the default title of a webform block.


Cross-site scripting (XSS) vulnerability in IBM Leads 7.x 8.1.0 before 8.1.0.14 8.2 8.5.0 before 8.5.0.7.3 8.6.0 before 8.6.0.8.1 9.0.0 through 9.0.0.4 9.1.0 before 9.1.0.6.1 and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL that triggers an error condition.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

zencart-ja

(aka

Zen

Cart

Japanese

edition)

jp

through

and

ja

through

ja

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

parameter

related

to

and


Multiple cross-site scripting (XSS) vulnerabilities in the IronPort Spam Quarantine (ISQ) page in Cisco AsyncOS as used on the Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters aka Bug IDs CSCus22925 and CSCup08113.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.8 and Maximo Asset Management 7.1 through 7.1.1.8 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2015-0104 CVE-2015-0107 and CVE-2015-0109.


Cross-site scripting (XSS) vulnerability in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 4.x before 4.0.7 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allow remote attackers to inject arbitrary web script or HTML via a crafted URL aka Bug ID CSCut39213.


Multiple cross-site scripting (XSS) vulnerabilities in dncs 7.0.0.12 in Cisco Headend Digital Broadband Delivery System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request aka Bug ID CSCur25604.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.8 and Maximo Asset Management 7.1 through 7.1.1.8 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2015-0104 CVE-2015-0107 and CVE-2015-0108.


Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued such as headers or arguments; (2) policy names which are not properly handled when viewing policies; (3) details for AMQP network clients such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content.


Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2015-0128.


Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the (1) fromCustomer (2) username or (3) password parameter to HomePage.do.


Cross-site scripting (XSS) vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Quality Manager (RQM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Team Concert (RTC) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Requirements Composer (RRC) 4.x through 4.0.7; and Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) for Microsoft Outlook allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL aka Bug ID CSCuu51400.


Cross-site

scripting

(XSS)

vulnerability

in

IBM

Business

Process

Manager

Standard

before

before

before

IBM

Business

Process

Manager

Express

before

before

before

and

IBM

Business

Process

Manager

Advanced

before

before

before


Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.


Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2015-0124.


Cross-site scripting (XSS) vulnerability in EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the CMP shared secret parameter.


Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in the Management Center component in Cisco FireSIGHT System Software 6.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified fields aka Bug IDs CSCus93566 CSCut31557 and CSCut47196.


Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2 8.0.x through 8.0.1.3 and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2015-0123.


Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31 6.7SP2 before P23 and 6.8 before P01; Documentum Administrator 6.7SP1 before P31 6.7SP2 before P23 7.0 before P18 7.1 before P15 and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Coach NG framework in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3 8.5.0 through 8.5.0.1 and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7 6.2.1 before 6.2.1.1 IF5 7.0 before FP4 and 7.1 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2014-8916.


Multiple cross-site scripting (XSS) vulnerabilities in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3 8.5.0 through 8.5.0.1 and 8.5.5 through 8.5.5.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified data fields.


CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via a crafted request aka Bug ID CSCur25580.


A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker could exploit this vulnerability by convincing a user to follow a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information.


The django.util.http.is_safe_url function in Django before 1.4.18 1.6.x before 1.6.10 and 1.7.x before 1.7.3 does not properly handle leading whitespaces which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL related to redirect URLs as demonstrated by a \\\njavascript:\ URL.


Cross-site scripting (XSS) vulnerability in the login page in Cisco TC Software before 7.1.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka Bug ID CSCuq94977.


Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging privileged access to set crafted values of unspecified fields.


Cross-site scripting (XSS) vulnerability in Cisco AsyncOS on the Web Security Appliance (WSA) 9.0.0-193; Email Security Appliance (ESA) 8.5.6-113 9.1.0-032 9.1.1-000 and 9.6.0-000; and Content Security Management Appliance (SMA) 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter aka Bug IDs CSCuu37430 CSCuu37420 CSCut71981 and CSCuv50167.


Cross-site scripting (XSS) vulnerability in EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allows remote attackers to inject arbitrary web script or HTML via vectors related to the email address parameter.


Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2 8.0 through 8.0.1.3 8.5.0 through 8.5.0.1 and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp.


Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2015-0122.


Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect a second IFRAME element that does not trigger a redirect and an eval of a WindowProxy object aka \Universal XSS (UXSS).\


Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Cisco Common Services as used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters aka Bug IDs CSCuq54654 and CSCun18263.


Cross-site scripting (XSS) vulnerability in the online help in Hitachi Device Manager Tiered Storage Manager Replication Manager and Global Link Manager before 8.1.2-00 and Compute Systems Manager before 7.6.1-08 and 8.x before 8.1.2-00 as used in Hitachi Command Suite allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php.


Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003 as used in Content Manager FileNet Content Manager Content Foundation Content Manager OnDemand and other products allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php.


Multiple cross-site scripting (XSS) vulnerabilities in u5CMS before 3.9.4 allow remote attackers to inject arbitrary web script or HTML via the (1) c (2) i (3) l or (4) p parameter to index.php; the (5) a or (6) b parameter to u5admin/cookie.php; the name parameter to (7) copy.php or (8) delete.php in u5admin/; the (9) f or (10) typ parameter to u5admin/deletefile.php; the (11) n parameter to u5admin/done.php; the (12) c parameter to u5admin/editor.php; the (13) uri parameter to u5admin/meta2.php; the (14) n parameter to u5admin/notdone.php; the (15) newname parameter to u5admin/rename2.php; the (16) l parameter to u5admin/sendfile.php; the (17) s parameter to u5admin/characters.php; the (18) page parameter to u5admin/savepage.php; or the (19) name parameter to u5admin/new2.php.


Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.


Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL aka \Audit Report Cross Site Scripting Vulnerability.\


Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted X-OWA-Canary cookie in an AD.RecipientType.User action aka \OWA Modified Canary Parameter Cross Site Scripting Vulnerability.\


Cross-site scripting (XSS) vulnerability in Sterling Order Management 8.5 before HF113 Sterling Selling and Fulfillment Foundation 9.0.0 before FP92 and Sterling Field Sales (SFS) 9.0 before HF7 in IBM Sterling Selling and Fulfillment Suite allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the Secure Web Mail Client user interface in McAfee Email Gateway (MEG) 7.6.x before 7.6.3.2 7.5.x before 75.6 7.0.x through 7.0.5 5.6 and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified tokens in Digest messages.


Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) order_by parameter to credentials/ (2) inventories/ (3) projects/ or (4) users/3/permissions/ in api/v1/ or the (5) next_run parameter to api/v1/schedules/.


Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the banner_effect_divid parameter in the BannerEffectOptions page to wp-admin/options-general.php.


Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remote authenticated users to inject arbitrary web script or HTML via the (1) domainname parameter to dnsProxy.cmd (DNS Proxy Configuration Panel); the (2) brName parameter to lancfg2get.cgi (Lan Configuration Panel); the (3) wlAuthMode (4) wl_wsc_reg or (5) wl_wsc_mode parameter to wlsecrefresh.wl (Wireless Security Panel); or the (6) wlWpaPsk parameter to wlsecurity.wl (Wireless Password Viewer).


Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0.0 through 7.0.0.2 CF29 8.0.0 before 8.0.0.1 CF16 and 8.5.0 through CF05 as used in Web Content Manager and other products allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL aka \ExchangeDLP Cross Site Scripting Vulnerability.\


Cross-site scripting (XSS) vulnerability in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1 11.0 before FP3 and 11.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site

scripting

(XSS)

vulnerability

in

the

function

in

in

Google

Chrome

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

by

leveraging

the

lack

of

a

certain

context

restriction

aka

a

Blink

\Universal

XSS

(UXSS).\


Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by (2) sort_order (3) items_view (4) dir (5) clipboard_task (6) clipboard_files (7) clipboard_src or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.


Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details or the (3) repository (4) repository group or (5) user group description.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before FP17 6.2.1 before FP9 and 6.2.2 before FP15 as used in Security Access Manager for Mobile and other products allow remote attackers to inject arbitrary web script or HTML via a crafted URL related to the (1) ERROR_DESCRIPTION and (2) TOKEN:RelayState macros.


Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2010 SP2 SharePoint Server 2010 SP2 SharePoint Foundation 2013 Gold and SP1 and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request aka \Microsoft SharePoint XSS Vulnerability.\


Cross-site scripting (XSS) vulnerability in the web server in IBM Domino 8.5.x before 8.5.3 FP6 IF8 and 9.x before 9.0.1 FP4 when Webmail is enabled allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL aka SPR KLYH9WYPR5.


Cross-site

scripting

(XSS)

vulnerability

in

in

Google

Chrome

before

on

Android

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

intent:

URL

as

demonstrated

by

a

trailing

alert(document.cookie);//

substring

aka

\Universal

XSS

(UXSS).\


Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter in a search request (2) username in a login request which is not properly handled when logging the event or (3) page title in an insert action.


program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.


Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lrealname field in the editProfile form to index.php/home/profile; the (2) datatitle or (3) datadescription field in the addQuickItem form to index.php; the (4) \note text\ field in the saveNote form to index.php/areas; or the (5) titleBEObject or (6) tagsArea field in the updateForm form to index.php/documents/view.


Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) dataCategorytitle parameter to admin/categories/add (2) dataFieldtitle parameter to admin/fields/ajax_fields/ (3) name property in a basicInfo JSON object to admin/tools/create_theme (4) dataLinklink_title parameter to admin/links/links/add or (5) dataForumTopicsubject parameter to forums/off-topic/new.


Cross-site scripting (XSS) vulnerability in IBM Tivoli Security Directory Server 6.0 before iFix 75 6.1 before iFix 68 6.2 before iFix 44 6.3 before iFix 37 6.3.1 before iFix 11 and 6.4 before iFix 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to admin/user_management.php (2) data_search parameter to /admin/profile_data.php or (3) filter parameter to error_log.php.


Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles.


Cross-site scripting (XSS) vulnerability in the REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2 8.0.x through 8.0.1.3 8.5.0 through 8.5.0.1 8.5.5 through 8.5.5.0 and 8.5.6 through 8.5.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the \edit gd infinite scroll settings\ permission to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5 6.4 before 6.4.3.1 and 7.1 before 7.1.3 and Tivoli Storage FlashCopy Manager for VMware 3.1 before 3.1.1.3 3.2 before 3.2.0.6 and 4.1 before 4.1.3.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw* parameter in an update action to wp-admin/admin-post.php as demonstrated by the mfbfwpadding parameter and exploited in the wild in February 2015.