Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.


Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.


IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Rational Team Concert 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


Cross-site

scripting

(XSS)

vulnerability

in

in

Foreman

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

network

interface

device

identifier

in

the

host

interface

form.


In Apache ActiveMQ 5.x before 5.14.2 an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.


IBM Rational Quality Manager (RQM) 4.0 5.0 and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.


Cross-site

scripting

(XSS)

vulnerability

in

the

dismissChangeRelatedObjectPopup

function

in

in

Django

before

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

vectors

involving

unsafe

usage

of

Element.innerHTML.


Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15 1.26.x before 1.26.4 and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.


Cross-site scripting (XSS) vulnerability in the Create Catalogue feature in Hybris Management Console (HMC) in SAP Hybris before 5.2.0.13 5.3.x before 5.3.0.11 5.4.x before 5.4.0.11 5.5.0.x before 5.5.0.10 5.5.1.x before 5.5.1.11 5.6.x before 5.6.0.11 and 5.7.x before 5.7.0.15 allows remote authenticated users to inject arbitrary web script or HTML via the ID field.


Multiple vulnerabilities in the web framework code of the Cisco Prime Collaboration Provisioning could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCut43061 CSCut43066 CSCut43736 CSCut43738 CSCut43741 CSCut43745 CSCut43748 CSCut43751 CSCut43756 CSCut43759 CSCut43764 CSCut43766. Known Affected Releases: 10.6.


IBM Quality Manager (RQM) 4.0 5.0 and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.


IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118352.


IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118383.


Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59 7.8.0 before 7.8.0-rev38 7.8.2 before 7.8.2-rev8; AppSuite frontend before 7.6.2-rev47 7.8.0 before 7.8.0-rev30 and 7.8.2 before 7.8.2-rev8; Office Web before 7.6.2-rev16 7.8.0 before 7.8.0-rev10 and 7.8.2 before 7.8.2-rev5; and Documentconverter-API before 7.8.2-rev5 allows remote attackers to inject arbitrary web script or HTML.


IBM Rational DOORS Next Generation 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1995515.


IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118356.


Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25 4.2.x before 4.2.14 and 4.4.x before 4.4.2 when the AlwaysDownloadAttachments config setting is not in use allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.


Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL aka Bug ID CSCuz58658.


IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 116755.


Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15 1.26.x before 1.26.4 and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.


Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3 4.x before 4.2.7.1 and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \HTML safe\ and used as attribute values in tag handlers.


IBM Resilient v26.0 v26.1 and v26.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference#: 213457065.


IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Rational Quality Manager 4.0 5.0 and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.


Cross-site scripting (XSS) vulnerability in Ektron Content Management System before 9.1.0.184SP3(9.1.0.184.3.127) allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to WorkArea/SelectUserGroup.aspx.


Cross-site scripting (XSS) vulnerability in the Create Employee feature in Hybris Management Console (HMC) in SAP Hybris before 5.0.4.11 5.1.0.x before 5.1.0.11 5.1.1.x before 5.1.1.12 5.2.0.x and 5.3.0.x before 5.3.0.10 5.4.x before 5.4.0.9 5.5.0.x before 5.5.0.9 5.5.1.x before 5.5.1.10 5.6.x before 5.6.0.8 and 5.7.x before 5.7.0.9 allows remote authenticated users to inject arbitrary web script or HTML via the Name field.


Cross-site scripting (XSS) vulnerability in Cisco Transport Gateway Installation Software 4.1(4.0) on Smart Call Home Transport Gateway devices allows remote attackers to inject arbitrary web script or HTML via a crafted value aka Bug IDs CSCva40650 and CSCva40817.


IBM Rational Quality Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 116896.


Cross-site scripting (XSS) vulnerability in the management interface in Huawei OceanStor ISM before V200R001C04SPC200 allows remote attackers to inject arbitrary web script or HTML via the loginName parameter to cgi-bin/doLogin_CgiEntry and possibly other unspecified vectors.


IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 116739.


A vulnerability in several parameters of the ccmivr page of Cisco Unified Communication Manager (CallManager) could allow an unauthenticated remote attacker to launch a cross-site scripting (XSS) attack against a user of the web interface on the affected system. More Information: CSCvb37121. Known Affected Releases: 11.5(1.2). Known Fixed Releases: 11.5(1.11950.96) 11.5(1.12900.2) 12.0(0.98000.133) 12.0(0.98000.313) 12.0(0.98000.404).


IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


Cross-site scripting (XSS) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1) as used in Unified Contact Center Express 10.0(1) through 11.0(1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL aka Bug IDs CSCuy75020 and CSCuy81652.


IBM Call Center for Commerce 9.3 and 9.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000442.


IBM Tivoli Key Lifecycle Manager 2.0.1 2.5 and 2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


A vulnerability in the web framework code of the Cisco IP Interoperability and Collaboration System (IPICS) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack. More Information: CSCva47092. Known Affected Releases: 4.10(1).


Cross-site scripting (XSS) vulnerability in Ektron Content Management System (CMS) before 9.1.0.184 SP3 (9.1.0.184.3.127) allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx.


IBM Verse is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail deleting data etc.) in case the user has an active session on the same domain already.


Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906 (2) dataBox plugin before 0.0.0.20160906 and (3) userBox plugin before 0.0.0.20160906 for Geeklog allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Carbon

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

setName

parameter

to

identity-mgt/challenges-mgt.jsp;

the

webappType

or

httpPort

parameter

to

the

dsName

or

description

parameter

to

ndatasource/newdatasource.jsp;

the

phase

parameter

to

viewflows/handlers.jsp;

or

the

url

parameter

to

ndatasource/validateconnection-ajaxprocessor.jsp.


Cross-site scripting (XSS) vulnerability in the email APP in Huawei PLK smartphones with software AL10C00 before AL10C00B211 and AL10C92 before AL10C92B211; ATH smartphones with software AL00C00 before AL00C00B361 CL00C92 before CL00C92B361 TL00HC01 before TL00HC01B361 and UL00C00 before UL00C00B361; CherryPlus smartphones with software TL00C00 before TL00C00B553 UL00C00 before UL00C00B553 and TL00MC01 before TL00MC01B553; and RIO smartphones with software AL00C00 before AL00C00B360 allows remote attackers to inject arbitrary web script or HTML via an email message.


Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1 8.1 before 8.1r2 8.0 before 8.0r9 and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2 Splunk Enterprise 6.3.x prior to 6.3.6 Splunk Enterprise 6.2.x prior to 6.2.10 Splunk Enterprise 6.1.x prior to 6.1.11 Splunk Enterprise 6.0.x prior to 6.0.12 Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3 Safari before 9.1.2 and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled by Safari.


Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1 8.1 before 8.1r2 8.0 before 8.0r9 and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Geeklog

IVYWE

edition

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

by

leveraging

use

of

the

function

in

or


Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8 as used in Apache Struts 2.x before 2.3.28 when using a single byte page encoding allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.


Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response related to a \cross-protocol cross-site scripting (XPXSS)\ vulnerability.


Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Template Name field when renaming a template; (2) KDC Server host (3) Kerberos Security Realm (4) Kerberos Encryption Types (5) Advanced Configuration Snippet (Safety Valve) for libdefaults section of krb5.conf (6) Advanced Configuration Snippet (Safety Valve) for the Default Realm in krb5.conf (7) Advanced Configuration Snippet (Safety Valve) for remaining krb5.conf or (8) Active Directory Account Prefix fields in the Kerberos wizard; or (9) classicWizard parameter to cmf/cloudera-director/redirect.


Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0 as used in WordPress before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter as demonstrated by \jsinitfunctio%gn.\


Cross-site

scripting

(XSS)

vulnerability

in

SAP

Manufacturing

Integration

and

Intelligence

(aka

MII

formerly

xMII)

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

title

parameter

to

webdynpro/resources/sap.com/xapps~xmii~ui~admin~navigation/NavigationApplication

aka

SAP

Security

Note


Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.


Cross-site

scripting

(XSS)

vulnerability

in

the

function

in

in

WordPress

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

attachment

name

a

different

vulnerability

than


Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allow remote attackers to inject arbitrary web script or HTML via the (1) token parameter to gwadmin-console/install/login.jsp or (2) PATH_INFO to gwadmin-console/index.jsp.


Cross-site scripting (XSS) vulnerability in Blink as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to inject arbitrary web script or HTML via vectors related to widget updates aka \Universal XSS (UXSS).\


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml (3) the Transformation implementation (4) AJAX error handling in js/ajax.js (5) the Designer implementation (6) the charts implementation in js/tbl_chart.js or (7) the zoom-search implementation in rows_zoom.phtml.


IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


Cross-site scripting (XSS) vulnerability in the Developer Tools (aka DevTools) subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to inject arbitrary web script or HTML via the settings parameter in a chrome-devtools-frontend.appspot.com URL's query string.


The Gerrit configuration in the Openstack Puppet module for Gerrit (aka puppet-gerrit) improperly marks text/html as a safe mimetype which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a crafted review.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

partition-range

implementation

in

in

the

table-structure

page

in

phpMyAdmin

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

crafted

table

parameters.


IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


Cross-site

scripting

(XSS)

vulnerability

in

in

Blink

as

used

in

Google

Chrome

before

on

Windows

and

OS

X

and

before

on

Linux

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

into

the

Developer

Tools

(aka

DevTools)

subsystem

via

a

crafted

web

site

aka

\Universal

XSS

(UXSS).\


Cross-site scripting (XSS) vulnerability in the Web UI in IBM Financial Transaction Manager (FTM) for ACH Services 3.0.0.x before fp0015 and 3.0.1.0 before iFix0002 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


A Cross Site Scripting (XSS) vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier aka F5 WebSafe Alert Server allows an unauthenticated user to inject HTML via a crafted alert.


IBM Interact 8.6 9.0 9.1 and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 115084.


Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox=\allow-scripts\ attribute value which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.


An issue was discovered in Visonic PowerLink2 all versions prior to October 2016 firmware release. User controlled input is not neutralized prior to being placed in web page output (CROSS-SITE SCRIPTING).


Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10 8.8 before 8.8.0.9049 FP9 9.0.0 and 9.0.1 before 9.0.1.1117 FP5 9.0.1A before 9.0.1.5108_9.0.1A FP5 9.0.2 before 9.0.2.1223 FP3 and 9.0.2A before 9.0.2.5224_9.0.2A FP3 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string a different vulnerability than CVE-2016-5978.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page (2) an \invalid JSON\ error message in the error console (3) a database name in the central columns implementation (4) a group name or (5) a search name in the bookmarks implementation.


IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


Cross-site scripting (XSS) vulnerability in IBM 10x as used in Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications before 1.0.0.5_2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name a different vulnerability than CVE-2016-5833.


IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Connections 4.0 4.5 5.0 and 5.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998294.


IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10 8.8 before 8.8.0.9049 FP9 9.0.0 and 9.0.1 before 9.0.1.1117 FP5 9.0.1A before 9.0.1.5108_9.0.1A FP5 9.0.2 before 9.0.2.1223 FP3 and 9.0.2A before 9.0.2.5224_9.0.2A FP3 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string a different vulnerability than CVE-2016-5975.


IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1997010.


Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.


Cross-site scripting (XSS) vulnerability in IBM FileNet Workplace XT through 1.1.5.2-WPXT-LA011 and FileNet Workplace (Application Engine) through 4.0.2.14-P8AE-IF001 when RegExpSecurityFilter and ScriptSecurityFilter are misconfigured allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in (1) revision.php (2) log.php (3) listing.php and (4) comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a (a) file or (b) directory in a repository.


Cross-site scripting (XSS) vulnerability on I-O DATA DEVICE WN-G300R devices with firmware 1.12 and earlier WN-G300R2 devices with firmware 1.12 and earlier and WN-G300R3 devices with firmware 1.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the file browser in Guacamole 0.9.8 and 0.9.9 when file transfer is enabled to a location shared by multiple users allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename. NOTE: this vulnerability was fixed in guacamole.war on 2016-01-13 but the version number was not changed.


Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7 RV130W devices with firmware before 1.0.3.16 and RV215W devices with firmware before 1.3.0.8 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter aka Bug ID CSCux82583.


Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Meeting Server (formerly Acano Conferencing Server) 1.7 through 1.9 allows remote attackers to inject arbitrary web script or HTML via crafted parameters aka Bug ID CSCva19922.


Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote authenticated users to inject arbitrary web script or HTML by leveraging basic administrative access to create a crafted policy leading to improper rendering on a certain Export IT screen.


A vulnerability in the display of email messages in the Messages in Quarantine (MIQ) view in Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a user to click a malicious link in the MIQ view. The malicious link could be used to facilitate a cross-site scripting (XSS) or HTML injection attack. More Information: CSCuz02235. Known Affected Releases: 8.0.2-069. Known Fixed Releases: 9.1.1-038 9.7.2-047.


Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lastname (2) firstname (3) email (4) job or (5) signature parameter to htdocs/user/card.php.


Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier WEX-300 devices with firmware 1.90 and earlier WHR-1166DHP devices with firmware 1.90 and earlier WHR-300HP2 devices with firmware 1.90 and earlier WHR-600D devices with firmware 1.90 and earlier WMR-300 devices with firmware 1.90 and earlier WMR-433 devices with firmware 1.01 and earlier and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the Redhen module 7.x-1.x before 7.x-1.11 for Drupal allow remote authenticated users with certain access to inject arbitrary web script or HTML via unspecified vectors related to (1) individual contacts (2) notes or (3) engagement scores.


Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12 8.0.x before 8.0.10 8.1.x before 8.1.5 and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Micro

Focus

Novell

Service

Desk

before

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

a

certain

user

name

or

parameter.


Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2015-7795 CVE-2015-7796 CVE-2015-7797 CVE-2015-7798 and CVE-2016-1150.


Multiple cross-site scripting (XSS) vulnerabilities in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to (1) mydevice/index.jsp or (2) mydevice/loggedOut.jsp.


Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) Runtime Workbench (RWB) or (2) Pmitest servlet in the Process Monitoring Infrastructure (PMI) aka SAP Security Notes 2206793 and 2234918.


Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the Extensions subsystem in Google Chrome before 50.0.2661.75 allows remote attackers to inject arbitrary web script or HTML via a crafted web site aka \Universal XSS (UXSS).\


Multiple cross-site scripting (XSS) vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input as demonstrated by a crafted attribute of an IMG element in the phone field of a user profile.


Cross-site scripting (XSS) vulnerability in the shiro8 (1) category_freearea_ addition_plugin plugin 1.0 and (2) itemdetail_freearea_ addition_plugin plugin 1.0 for EC-CUBE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via newline characters in a filename.


Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2015-7795 CVE-2015-7796 CVE-2015-7797 CVE-2015-7798 and CVE-2016-1149.


CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF sequences in the mimetype parameter as demonstrated by a request to blob/cgit.c.


Cross-site scripting (XSS) vulnerability in the Case Management application in EMC RSA Adaptive Authentication (On-Premise) before 6.0.2.1.SP3.P4 HF210 7.0.x and 7.1.x before 7.1.0.0.SP0.P6 HF50 and 7.2.x before 7.2.0.0.SP0.P0 HF20 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2016-2888 and CVE-2016-0350.


Cross-site scripting (XSS) vulnerability in the My Reports component in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6 3.4 before 3.4.2.3 and 3.5 before 3.5.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111785.


Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1 2013 Cumulative Update 10 and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL aka \Exchange Spoofing Vulnerability.\


Cross-site

scripting

(XSS)

vulnerability

in

IBM

Rational

Collaborative

Lifecycle

Management

before

before

before

and

before

Rational

Quality

Manager

before

before

before

and

before

Rational

Team

Concert

before

before

before

and

before

Rational

DOORS

Next

Generation

before

before

and

before

Rational

Engineering

Lifecycle

Manager

before

before

and

before

Rational

Rhapsody

Design

Manager

before

before

and

before

and

Rational

Software

Architect

Design

Manager

before

before

and

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

URL.


Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2016-2888 and CVE-2016-0313.


Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart aka \Microsoft SharePoint Security Feature Bypass \ a different vulnerability than CVE-2015-6117.


Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111737.


Cross-site scripting (XSS) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110562.


Cross-site scripting (XSS) vulnerability in IBM Cognos TM1 as used in IBM Cognos Business Intelligence 10.2 before IF20 10.2.1 before IF17 10.2.1.1 before IF16 10.2.2 before IF12 and 10.1.1 before IF19 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL aka \Exchange Spoofing Vulnerability \ a different vulnerability than CVE-2016-0029.


Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL aka \Exchange Spoofing Vulnerability \ a different vulnerability than CVE-2016-0031.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27 6.1.5.x through 6.1.5.3 CF27 7.x through 7.0.0.2 CF29 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2016-0244.


The administration web console in Apache ActiveMQ 5.x before 5.11.4 5.12.x before 5.12.3 and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.


Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 6.0.1 and 6.0.2 before 6.0.2 iFix2 and Rational Collaborative Lifecycle Management 6.0.1 and 6.0.2 before 6.0.2 iFix2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the document-list control implementation in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3 8.5.0 through 8.5.0.2 and 8.5.5 and 8.5.6 through 8.5.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in Apps Manager in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject arbitrary web script or HTML via unspecified input that improperly interacts with the AngularJS framework.


Cross-site

scripting

(XSS)

vulnerability

in

IBM

Rational

Collaborative

Lifecycle

Management

before

before

before

and

before

Rational

Quality

Manager

before

before

before

and

before

Rational

Team

Concert

before

before

before

and

before

Rational

DOORS

Next

Generation

before

before

and

before

Rational

Engineering

Lifecycle

Manager

before

before

and

before

Rational

Rhapsody

Design

Manager

before

before

and

before

and

Rational

Software

Architect

Design

Manager

before

before

and

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

field.


Cross-site scripting (XSS) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6 3.4 before 3.4.2.4 and 3.5 before 3.5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2016-2883.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27 6.1.5.x through 6.1.5.3 CF27 7.x through 7.0.0.2 CF29 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2016-0243.


Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV-BSM-FP0004 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111480.


Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence 10.2 before IF20 10.2.1 before IF17 10.2.1.1 before IF16 10.2.2 before IF12 and 10.1.1 before IF19 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in IBM Information Server Framework 8.5 Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2 Information Server Framework and InfoSphere Information Server Business Glossary 9.1 before 9.1.2.0 Information Server Framework and InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and Information Server Framework and InfoSphere Information Governance Catalog 11.5 before 11.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1 2013 Cumulative Update 10 2013 Cumulative Update 11 and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL aka \Exchange Spoofing Vulnerability.\


Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10 2.9.x before 2.9.4 and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.


Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29 6.0.4 before 6.0.4.6 iFix3 6.0.5 before 6.0.5.9 iFix2 6.1.0 before 6.1.0.1 iFix1 and 6.1.1 before 6.1.1.1 iFix1; and IBM Care Management 6.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110604.


Cross-site scripting (XSS) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6 3.4 before 3.4.2.4 and 3.5 before 3.5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2016-0387.


Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11 2.7.x before 2.7.13 2.8.x before 2.8.11 2.9.x before 2.9.5 and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an external DB profile field.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4 4.5 through CR5 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2016-2997 CVE-2016-3005 and CVE-2016-3010.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name (2) SET value (3) search query or (4) hostname in a Location header.


Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x 4.2.x and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message which is not properly handled in the \detailed status\ page or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message which is not properly handled in the \status\ page.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2016-2956 and CVE-2016-3008.


IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113945.


IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113935.


An issue was discovered in Adcon Telemetry A850 Telemetry Gateway Base Station. The Web Interface does not neutralize or incorrectly neutralizes user-controllable input before it is placed in the output; this could allow for cross-site scripting.


Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11 2.7.x before 2.7.13 2.8.x before 2.8.11 2.9.x before 2.9.5 and 3.0.x before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted field in a URL as demonstrated by a search form field.


Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.


Cross-site

scripting

(XSS)

vulnerability

in

IBM

Rational

Collaborative

Lifecycle

Management

before

before

and

before

Rational

Quality

Manager

before

before

and

before

Rational

Team

Concert

before

before

and

before

Rational

DOORS

Next

Generation

before

before

and

before

Rational

Engineering

Lifecycle

Manager

before

before

and

before

Rational

Rhapsody

Design

Manager

before

before

and

before

and

Rational

Software

Architect

Design

Manager

before

before

and

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

URL.


Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) ns or (2) interface parameter to ProxyServer/register aka SAP Security Note 2220571.


Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the label parameter to admin/BunchDetail.do; (2) the package_name (3) search_subscribed_channels or (4) channel_filter parameter to software/packages/NameOverview.do; or unspecified vectors related to (5) <input:hidden> or (6) <bean:message> tags.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2016-2954 and CVE-2016-3008.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

phpMyAdmin

before

and

before

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

normalization.php

or

js/normalization.js

in

the

database

normalization

page

in

the

database

structure

page

or

the

pos

parameter

to

in

the

central

columns

page.


IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Sametime away message altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113848.


Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2016-0313 and CVE-2016-0350.


Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page.


IBM Infosphere BigInsights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2 when Smarty Cache is activated allow remote attackers to conduct cache poisoning attacks modify links and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.


Cross-site scripting (XSS) vulnerability in HPE Network Node Manager i (NNMi) 9.20 9.23 9.24 9.25 10.00 and 10.01 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2016-2011.


Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 6.x before 6.0.1 iFix6 Rational Quality Manager 6.x before 6.0.1 iFix6 Rational Team Concert 6.x before 6.0.1 iFix6 Rational DOORS Next Generation 6.x before 6.0.1 iFix6 Rational Engineering Lifecycle Manager 6.x before 6.0.1 iFix6 and Rational Rhapsody Design Manager 6.x before 6.0.1 iFix6 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


IBM Sametime Media Services 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113899.


Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the list_1680466951_oldfilterval parameter to systems/PhysicalList.do or (2) unspecified vectors involving systems/VirtualSystemsList.do.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27 6.1.5.x through 6.1.5.3 CF27 7.x through 7.0.0.2 CF30 8.0.0.x through 8.0.0.1 CF21 and 8.5.0 before CF10 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


The

function

in

Django

before

and

before

allows

remote

attackers

to

redirect

users

to

arbitrary

web

sites

and

conduct

phishing

attacks

or

possibly

conduct

cross-site

scripting

(XSS)

attacks

via

a

URL

containing

basic

authentication

as

demonstrated

by


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

phpMyAdmin

before

before

and

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

Host

HTTP

header

related

to

libraries/Config.class.php;

crafted

JSON

data

related

to

a

crafted

SQL

query

related

to

js/functions.js;

the

initial

parameter

to

in

the

user

accounts

page;

or

the

it

parameter

to

in

the

zoom

search

page.


Mozilla Firefox before 47.0 ignores Content Security Policy (CSP) directives for cross-domain Java applets which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted applet.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4 4.5 through CR5 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2016-2995 CVE-2016-3005 and CVE-2016-3010.


Multiple cross-site scripting (XSS) vulnerabilities on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) getimageajax.php (2) move_partition_frame.html or (3) wmInfo.html.


Cross-site

scripting

(XSS)

vulnerability

in

in

Horde

Groupware

before

and

Horde

Groupware

Webmail

Edition

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

searchfield

parameter

as

demonstrated

by

a

request

to


Cross-site scripting (XSS) vulnerability in HPE Network Node Manager i (NNMi) 9.20 9.23 9.24 9.25 10.00 and 10.01 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2016-2010.


Cross-site

scripting

(XSS)

vulnerability

in

IBM

Rational

Collaborative

Lifecycle

Management

before

before

before

and

before

Rational

Quality

Manager

before

before

before

and

before

Rational

Team

Concert

before

before

before

and

before

Rational

DOORS

Next

Generation

before

before

and

before

Rational

Engineering

Lifecycle

Manager

before

before

and

before

Rational

Rhapsody

Design

Manager

before

before

and

before

and

Rational

Software

Architect

Design

Manager

before

before

and

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

URL.


Cross-site scripting (XSS) vulnerability in McAfee Email Gateway (MEG) 7.6.x before 7.6.404 when File Filtering is enabled with the action set to ESERVICES:REPLACE allows remote attackers to inject arbitrary web script or HTML via an attachment in a blocked email.


The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site aka \Internet Explorer XSS Filter Vulnerability.\


Cross-site

scripting

(XSS)

vulnerability

in

SAP

NetWeaver

AS

Java

through

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

navigationTarget

parameter

to

irj/servlet/prt/portal/prteventname/XXX/prtroot/com.sapportals.navigation.testComponent.NavigationURLTester

aka

SAP

Security

Note


Cross-site scripting (XSS) vulnerability in the appliance web-application in Fortinet FortiManager 5.x before 5.0.12 5.2.x before 5.2.6 and 5.4.x before 5.4.1 and FortiAnalyzer 5.x before 5.0.13 5.2.x before 5.2.6 and 5.4.x before 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string a different vulnerability than CVE-2016-3001 and CVE-2016-3003.


Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Wireless Framework. NOTE: the previous information is from the July 2016 CPU. Oracle has not commented on third-party claims that this issue is a cross-site scripting (XSS) vulnerability which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13 5.2.x before 5.2.3 and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the \redirect\ parameter to \login.\


Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Remote Launch. NOTE: the previous information is from the July 2016 CPU. Oracle has not commented on third-party claims that this issue is a cross-site scripting (XSS) vulnerability which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string a different vulnerability than CVE-2016-3001 and CVE-2016-3006.


IBM OpenPages GRC Platform 7.1 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 114711.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Sophos

Cyberoam

UTM

appliance

with

firmware

build

UTM

appliance

with

firmware

build

and

UTM

appliance

with

firmware

Build

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

ipFamily

parameter

to

the

ipFamily

applicationname

or

username

parameter

to

or

the

X-Forwarded-For

HTTP

header.


Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to systems/SystemEntitlements.do; (2) the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a (3) snapshot tag or (4) system group in System Set Manager (SSM).


IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 114516.


IBM Cognos TM1 10.1 and 10.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 114614.


IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998887.


Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string a different vulnerability than CVE-2016-3003 and CVE-2016-3006.


Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 through 7.5.1.2 8.0 through 8.0.1.3 and 8.5 before 8.5.7.0 CF2016.09 allows remote authenticated users to inject arbitrary web script or HTML via crafted content.


Cross-site scripting (XSS) vulnerability in wallpaper.php in the Base Unit in Barco ClickShare CSC-1 devices with firmware before 01.09.03 CSM-1 devices with firmware before 01.06.02 and CSE-200 devices with firmware before 01.03.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4 4.5 through CR5 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2016-2995 CVE-2016-2997 and CVE-2016-3010.


Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6 12.1 and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to JRAD Heartbeat. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that that this issue involves multiple cross-site scripting (XSS) vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via three unspecified parameters in an unknown JSP file.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2016-2954 and CVE-2016-2956.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4 4.5 through CR5 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2016-2995 CVE-2016-2997 and CVE-2016-3005.


Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 12.1.1 12.1.2 and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Deliverables. NOTE: the previous information is from the July 2016 CPU. Oracle has not commented on third-party claims that this issue involves multiple cross-site scripting (XSS) vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Unspecified vulnerability in the Oracle Advanced Inbound Telephony component in Oracle E-Business Suite 12.1.1 12.1.2 and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to SDK client integration. NOTE: the previous information is from the July 2016 CPU. Oracle has not commented on third-party claims that this issue involves multiple cross-site scripting (XSS) vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site

scripting

(XSS)

vulnerability

in

IBM

Rational

Collaborative

Lifecycle

Management

before

and

before

Rational

Quality

Manager

before

and

before

Rational

Team

Concert

before

and

before

Rational

DOORS

Next

Generation

before

and

before

Rational

Engineering

Lifecycle

Manager

before

and

before

Rational

Rhapsody

Design

Manager

before

and

before

and

Rational

Software

Architect

Design

Manager

before

and

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors.


Pixel-Apes SafeHTML before 1.2.1 allows remote attackers to bypass cross-site scripting (XSS) protection via \hexadecimal HTML entities.\


Multiple cross-site scripting vulnerabilities in MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to login.html (2) accountid parameter to accountsettings_add.html or the (3) note (4) title and (5) location fields to calendar.html.


Cross-site scripting (XSS) vulnerability in settings.inc.php for CubeCart 2.0.0 through 2.0.5 as used in multiple PHP files allows remote attackers to inject arbitrary HTML or web script via the (1) cat_id (2) PHPSESSID (3) view_doc (4) product (5) session (6) catname (7) search or (8) page parameters.


Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via (1) the strServer cfgBgcolorOne or strServerChoice parameters in select_server.lib.php (2) the bg_color or row_no parameters in display_tbl_links.lib.php the left_font_family parameter in theme_left.css.php or the right_font_family parameter in theme_right.css.php.


Cross-site scripting (XSS) vulnerability in phpCOIN 1.2.0 through 1.2.1b allows remote attackers to inject arbitrary web script or HTML via (1) the new parameter to mod.php (2) the w parameter to mod.php (3) the e parameter to login.php (4) the o parameter to login.php and possibly other scripts.


Multiple cross-site scripting (XSS) vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) register a new user page (2) User-Agent or (3) Username which is not properly quoted before sending to the error log.


Direct remote injection vulnerability in modalfram.wdm in Alt-N WebAdmin 3.0.4 allows remote attackers to load external webpages that appear to come from the WebAdmin server which allows remote attackers to inject arbitrary HTML or web script to facilitate cross-site scripting (XSS) and phishing attacks.


Multiple cross-site scripting (XSS) vulnerabilities in ProductCart 2.7 allow remote attackers to inject arbitrary web script or HTML via (1) the keyword parameter to advSearch_h.asp (2) the redirectUrl parameter to NewCust.asp (3) the country parameter to storelocator_submit.asp or (4) the error parameter to techErr.asp. NOTE: it has been reported that storelocator_submit.asp does not exist in ProductCart.


Multiple cross-site scripting (XSS) vulnerabilities in the Download module for PostNuke 0.750 and 0.760-RC2 allow remote attackers to inject arbitrary web script or HTML via the (1) Program name (2) File link (3) Author name (4) Author e-mail address (5) File size (6) Version or (7) Home page variables.


Cross-site scripting (XSS) vulnerability in PHPOpenChat v3.x allows remote attackers to inject arbitrary web script or HTML via (1) the chatter parameter to regulars.php or (2) the chatter chatter1 chatter2 chatter3 or chatter4 parameters to register.php.


Cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL (\jav&#X41sc
ript:\) in an IMG tag.


Windows SharePoint Services and SharePoint Team Services for Windows Server 2003 does not properly validate an HTTP redirection query which allows remote attackers to inject arbitrary HTML and web script via a cross-site scripting (XSS) attack or to spoof the web cache.


Multiple cross-site scripting (XSS) vulnerabilities in ProjectBB 0.4.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) the pages parameter to divers.php (incorrectly referred to as \drivers.php\ by some sources) (2) in the search feature text area (3) forum name (4) site name or (5) the maximum avatar size in the option section (5) new category or (6) new forum fields in the forum section.


Multiple cross-site scripting (XSS) vulnerabilities in ReviewPost PHP Pro before 2.84 allow remote attackers to inject arbitrary web script or HTML via the (1) si parameter to showcat.php (2) cat or (3) page parameter to showproduct.php or (4) report parameter to reportproduct.php.


Cross-site scripting (XSS) vulnerability in TrackerCam 5.12 and earlier allows remote attackers to inject arbitrary HTML or web script via the login request which is recorded in a log file but not properly handled when the administrator views the log file.


Multiple vulnerabilities in Pixel-Apes SafeHTML before 1.3.0 allow remote attackers to bypass cross-site scripting (XSS) protection via (1) \decimal HTML entities\ or (2) \the \\x00 symbol.\


Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters including \>\ and \<\.


Cross-site scripting (XSS) vulnerability in usercp_register.php for phpBB 2.0.13 allows remote attackers to inject arbitrary web script or HTML by setting the (1) allowhtml (2) allowbbcode or (3) allowsmilies parameters to inject HTML into signatures for personal messages possibly when they are processed by privmsg.php or viewtopic.php.


Multiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters including \>\ and \<\.


Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 5.x allow remote attackers to inject arbitrary web script or HTML via the (1) cat (2) password (3) ppuser (4) sort or (5) si parameters to showgallery.php the (6) ppuser (7) sort or (8) si parameters to showmembers.php or (9) the photo parameter to slideshow.php.


Adventia Chat 3.1 and Server Pro 3.0 allows remote attackers to inject arbitrary web script or HTML into the chat space which leaves other users vulnerable to cross-site scripting (XSS) attacks.


Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 7.5 allow remote attackers to inject arbitrary HTML or web script via (1) the newdownloadshowdays parameter in a NewDownloads operation or (2) the newlinkshowdays parameter in a NewLinks operation.


Multiple cross-site scripting (XSS) vulnerabilities in PBLang 4.65 allow remote attackers to inject arbitrary web script or HTML via (1) the search string to search.php (2) the subject of a PM which is processed by pm.php or (3) the body of a PM which is processed by pmpshow.php.


Apple Safari 1.2.4 does not obey the Content-type field in the HTTP header and renders text as HTML which allows remote attackers to inject arbitrary web script or HTML and perform cross-site scripting (XSS) attacks.


Cross-site scripting (XSS) vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via (1) a signature file or (2) a message post containing an IMG tag within a COLOR tag whose style is set to background:url.


index.php in CubeCart 2.0.4 allows remote attackers to (1) obtain the full path for the web server or (2) conduct cross-site scripting (XSS) attacks via an invalid language parameter which echoes the parameter in a PHP error message.


Multiple cross-site scripting (XSS) vulnerabilities in phpSysInfo 2.3 when register_globals is enabled allow remote attackers to inject arbitrary web script or HTML via the (1) sensor_program parameter to index.php (2) textlanguage (3) texttemplate or (4) hide_picklist parameter to system_footer.php.


Cross-site scripting (XSS) vulnerability in EMotion MediaPartner Web Server 5.0 allows remote attackers to inject arbitrary HTML or web script as demonstrated using a URL containing .. sequences and HTML which results in a directory browsing page that does not properly filter the HTML.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Gallery

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

index

field

in

fields

in

or

username

field

in

search.php.


Cross-site scripting (XSS) vulnerability in the jumpmenu function in functions.php for paFileDB 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameters which is not properly cleansed in the $pageurl variable as demonstrated using pafiledb.php.


Multiple cross-site scripting (XSS) vulnerabilities in Help Center Live allow remote attackers to inject arbitrary web script or HTML via the (1) find parameter to index.php (2) name or (3) message field of a chat request or (4) the message body when opening a trouble ticket.


Multiple cross-site scripting (XSS) vulnerabilities in CartWIZ ASP Cart allow remote attackers to inject arbitrary web script or HTML via the idProduct parameter to (1) tellAFriend.asp or (2) addToWishlist.asp redirect parameter to (3) access.asp or (4) login.asp message parameter to (5) login.asp or (6) error.asp or (7) sku or (8) name parameter to searchResults.asp.


Cross-site scripting (XSS) vulnerability in MidiCart PHP Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the (1) searchstring parameter to search_list.php or the (2) secondgroup or (3) maingroup parameters to item_list.php.


Multiple cross-site scripting (XSS) vulnerabilities in Groove Mobile Workspace in Groove Virtual Office before 3.1 build 2338 before 3.1a build 2364 and Groove Workspace before 2.5n build 1871 allow remote attackers to inject arbitrary web script or HTML via the (1) picture columns embedded within SharePoint lists or (2) drop-down menus in a SharePoint list.


Multiple cross-site scripting (XSS) vulnerabilities in PhpBB Plus 1.52 and earlier allow remote attackers to inject arbitrary web script or HTML via the bsid parameter to (1) groupcp.php (2) index.php (3) portal.php (4) viewforum.php or (5) viewtopic.php (6) the c parameter to index.php or (7) the article parameter to portal.php.


Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary script in other domains via a setter function for a variable in the target domain which is executed when the user visits that domain aka \Cross-site scripting through global scope pollution.\


Multiple cross-site scripting (XSS) vulnerabilities in Active Auction House allow remote attackers to inject arbitrary web script or HTML via the (1) ReturnURL (2) password (3) username parameter (4) ReturnURL parameter to account.asp (5) Table (6) Title parameter to sendpassword.asp or (7) itemid to watchthisitem.asp.


Multiple cross-site scripting (XSS) vulnerabilities in Argosoft Mail Server Pro 1.8.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the src parameter in an IMG tag (2) User settings or (3) Address book input boxes in the webmail interface.


Multiple cross-site scripting (XSS) vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) cat or (2) printable parameter to home.php (3) productid or (4) mode parameter to product.php (5) id parameter to error_message.php (6) section parameter to help.php (7) mode parameter to orders.php (8) mode parameter to register.php (9) mode parameter to search.php or the (10) gcid or (11) gcindex parameter to giftcert.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Claroline

through

Release

Candidate

and

possibly

Dokeos

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

agenda.php

learningPathList.php

learningPathAdmin.php

learningPath.php

userLog.php

tool

parameter

to

data

parameter

to

or

coursePath

parameter

to

myagenda.php.


Multiple cross-site scripting (XSS) vulnerabilities in (1) start_page.css.php3 (aka start-page.css.php3) or (2) style.css.php3 in PHPMyChat 0.14.5 allow remote attackers to inject arbitrary web script or HTML commands via the FontName parameter. NOTE: it was later reported that 0.14.5 is also affected.


Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the bid parameter to the EmailStats op in banners.pgp (2) the ratenum parameter in the TopRated and MostPopular actions in the Web_Links module (3) the ttitle parameter in the viewlinkdetails viewlinkeditorial viewlinkcomments and ratelink actions in the Web_Links module or (4) the username parameter in the Your_Account module.


The web server control panel in 602LAN SUITE 2004 allows remote attackers to make it more difficult for the administrator to read portions of log files via a \</pre><!-\ sequence in an HTTP GET request in the logon possibly due to a cross-site scripting (XSS) vulnerability.


The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist such as update.mozilla.org or addon.mozilla.org to execute arbitrary Javascript with chrome privileges leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476 as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.


Cross-site scripting (XSS) vulnerability in the guestbook for SiteStudio 1.6 allows remote attackers to inject arbitrary web script or HTML via the name field to (1) psoft.guestbook.GuestBookServ in Standalone Site Studio or (2) E-Guest_sign.pl in Integrated Site Studio with H-Sphere.


Multiple cross-site scripting vulnerabilities in FishCart 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) trackingnum (2) reqagree or (3) m parameter to upstracking.php or (4) nlst parameter to display.php. NOTE: the vendor was not able to reproduce some of the reported vectors but believes that they have been addressed. The original researcher is known to be unreliable.


Multiple cross-site scripting (XSS) vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) anzahl_beitraege parameter to jgs_portal.php (2) year parameter to jgs_portal_statistik.php (3) year parameter to jgs_portal_beitraggraf.php (4) tag parameter to jgs_portal_viewsgraf.php (5) year parameter to jgs_portal_themengraf.php (6) year parameter to jgs_portal_mitgraf.php (7) id parameter to jgs_portal_sponsor.php or (8) the Accept-Language header to jgs_portal_log.php. NOTE: this issue may stem from the same core problem as CVE-2005-1633.


Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.750 and 0.760RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) skin or (2) paletteid parameter to demo.php in the Xanthia module or (3) the serverName parameter to config.php in the Multisites (aka NS-Multisites) module.


The _writeAttrs function in SafeHTML before 1.3.2 does not properly handle quotes in attribute values which could allow remote attackers to exploit cross-site scripting (XSS) vulnerabilities in applications that rely on SafeHTML for protection.


** DISPUTED ** NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in calendar.pl in CalendarScript 3.20 allows remote attackers to inject arbitrary web script or HTML via the template parameter a different vulnerability than CVE-2005-1146.


Multiple cross-site scripting (XSS) vulnerabilities in Net Portal Dynamic System (NPDS) 5.0 allow remote attackers to inject arbitrary web script or HTML via the language parameter to (1) admin.php or (2) powerpack_f.php (3) the sitename parameter to sdv_infos.php (4) the categories parameter to faq.php (5) the lettre parameter to the glossaire module (6) the title parameter to reviews.php or (7) the image_subject parameter to reply.php.


Multiple cross-site scripting (XSS) vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 and earlier allow remote attackers to execute arbitrary web script or HTML via the (1) forums (2) version or (3) limit parameter to misc.php (4) page or (5) datecut parameter to forumdisplay.php (6) username (7) email or (8) email2 parameter to member.php (9) page or (10) usersearch parameter to memberlist.php (11) pid or (12) tid parameter to showthread.php or (13) tid parameter to printthread.php.


Multiple cross-site scripting (XSS) vulnerabilities in ViArt Shop Enterprise 2.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) various parameters to basket.php (2) the nickname email topic and message fields in forum.php as demonstrated using forum_new_thread.php and forum_thread.php (3) the page parameter to page.php (4) category_id and item_id parameters to reviews.php (5) the category_id parameter to product_details.php (6) the category_id or search_string parameters to products.php or (7) the rp or page parameters to news_view.php.


Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) module parameter to admin.php or (2) op parameter to user.php. NOTE: the vendor reports that certain issues could not be reproduced for 760 RC3 or for .750. However the op/user.php issue exists when the pnAntiCracker setting is disabled.


Multiple cross-site scripting (XSS) vulnerabilities in myBloggie 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) year parameter in viewmode.php or the (2) cat_id (3) month_no or (4) post_id parameter in index.php which are not properly sanitized before they are displayed in an error message. NOTE: issues 2 3 and 4 may be due to a problem in associated products rather than myBloggie itself.


Multiple cross-site scripting (XSS) vulnerabilities in OneWorldStore allow remote attackers to inject arbitrary web script or HTML via the (1) sEmail parameter to owContactUs.asp (2) bSub parameter to owListProduct.asp or the (3) Name (4) Email or (5) Comment fields in owProductDetail.asp.


Multiple cross-site scripting (XSS) vulnerabilities in SitePanel 2.6.1 and earlier (SitePanel2) allows remote attackers to inject arbitrary web script or HTML via (1) the v show or sec_name parameters to main.php (2) the inadmin newsev or postid parameters to 5.php or (3) the id parameter to 0.php.


Multiple cross-site scripting (XSS) vulnerabilities in Annuaire 1Two 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the id parameter to index.php or the (2) site_id (3) nom (4) email or (5) commentaire parameters in commentaires.php.


Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x to 7.6 allow remote attackers to inject arbitrary web script or HTML via the (1) min parameter to the Search module (2) the categories parameter to the FAQ module or (3) the ltr parameter to the Encyclopedia module. NOTE: the bid parameter issue in banners.php is already an item in CVE-2005-1000.


Cross-site scripting (XSS) vulnerability in index.php for TOPo 2.2 (2.2.178) allows remote attackers to inject arbitrary web script or HTML via the (1) m (2) s (3) ID or (4) t parameters or the (5) field name (6) Your Web field or (7) email field in the comments section.


Multiple cross-site scripting (XSS) vulnerabilities in Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) the E-mail address Note or Public Certificate fields to address.html (2) addressaction.html (3) the Signature field to settings.html or (4) the Shared calendars to calendarsettings.html.


Cross-site scripting (XSS) vulnerability in Opera 8.0 Final Build 1095 allows remote attackers to inject arbitrary web script or HTML via \javascript:\ URLs when a new window or frame is opened which allows remote attackers to bypass access restrictions and perform unauthorized actions on other domains.


Multiple cross-site scripting (XSS) vulnerabilities in JustWilliam's Amazon Webstore 04050100 allow remote attackers to inject arbitrary web script or HTML via the (1) image parameter to closeup.php the (2) currentIsExpanded or (3) searchFor parameters to index.php (4) the currentNumber parameter to software_CAD_Technical_60002_uk.htm or (5) a cookie.


Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to (1) add_review.htm (2) suggest_review.htm (3) suggest_category.htm (4) add_booklist.htm or (5) add_url.htm the isbn parameter to (6) add_review.htm (7) add_contents.htm (8) add_classification.htm the (9) chapters parameter to the add_contents page in index.php (aka add_contents.htm) (10) the user parameter to contact.htm or (11) the submitstring parameter to search.htm. NOTE: it is not clear whether BookReview is available to the public. If not then it should not be included in CVE.


Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x through 7.6 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter in the Your_Account module (2) avatarcategory parameter in the Your_Account module or (3) lid parameter in the Downloads module.


Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via (1) the t parameter to view.php (2) the osticket_title parameter to header.php (3) the em parameter to admin_login.php (4) the e parameter to user_login.php (5) the err parameter to open_submit.php or (6) the name and subject fields when adding a ticket.


** DISPUTED ** NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in the login command in calendar.pl in CalendarScript 3.21 allows remote attackers to inject arbitrary web script or HTML via the username parameter a different vulnerability than CVE-2005-1145.


Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) u parameter to profile.php (2) highlight parameter to viewtopic.php or (3) forumname or forumdesc parameters to admin_forums.php.


Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4 and 7.0 through Service Pack 6 allow remote attackers to inject arbitrary web script or HTML and possibly gain administrative privileges via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp) (3) parameters to the error page in the Administration Console (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password.


Musicmatch Jukebox 10.00.2047 and earlier adds the musicmatch.com domain to the Trusted Sites zone in Internet Explorer which allows systems in the domain to conduct unauthorized activities as demonstrated using cross-site scripting (XSS) attacks.


Multiple cross-site scripting (XSS) vulnerabilities in Blue Coat Reporter before 7.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the username in an Add User window or (2) the license key (volatile.license_to_add parameter) in the Licensing page.


Multiple cross-site scripting (XSS) vulnerabilities in pafiledb.php in paFileDB 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) sortby or (2) filelist parameters to the category action (category.php) or (3) pages parameter in the viewall action (viewall.php).


Multiple cross-site scripting (XSS) vulnerabilities in PwsPHP 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) month or (2) annee parameters to the news module (3) nbractif or (4) annee parameters to the stats module (5) id parameter to profil.php (6) mb_lettre or (7) lettre parameter to memberlist.php or (8) chaine_search or (9) auteur_search parameter to the recherche module.


Multiple cross-site scripting (XSS) vulnerabilities in the RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) rss_url parameter to magpie_slashbox.php or the url parameter to (2) magpie_simple.php or (3) magpie_debug.php.


Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) entry (2) blog_subject and (3) blog_text parameters (involving the temp_subject variable) in (a) preview_cgi.php and (b) preview_static_cgi.php or (4) scheme_name parameter and (5) bg_color parameters (involving the preset_name and result variables) in (c) colors.php.


Multiple cross-site scripting (XSS) vulnerabilities in e-Quick Cart allow remote attackers to inject arbitrary web script or HTML via the (1) strgifttoname parameter in shopgift.asp (2) strfirstname parameter in shopmaillist.asp (3) strpid parameter in shopprojectlogin.asp and (4) Custname parameter in shoptellafriend.asp.


Cross-site scripting (XSS) vulnerability in the management interface for VMware ESX 2.5.x before 2.5.2 upgrade patch 2 2.1.x before 2.1.2 upgrade patch 6 and 2.0.x before 2.0.1 upgrade patch 6 allows remote attackers to inject arbitrary web script or HTML via messages that are not sanitized when viewing syslog log files.


Cross-site scripting (XSS) vulnerability in AMAX Magic Winmail Server 4.2 (build 0824) and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) retid parameter in badlogin.php (2) Content-Type headers in HTML mails and (3) HTML mail attachments.


Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance and possibly Google Search Appliance allows remote attackers to inject arbitrary Javascript and possibly other web script or HTML via the proxystylesheet variable which will be executed in the resulting error message.


Multiple cross-site scripting (XSS) vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and values such as the (1) legend tag and the value parameter used in (2) label and (3) input tags possibly due to an incomplete blacklist.


Multiple interpretation error in the image upload handling code in Invision Gallery 2.0.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML or script in an image whose type does not match its extension which is rendered by Internet Explorer due to CVE-2005-3312. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so then this should not be treated as a vulnerability in Invision Gallery.


The HTML rendering engine in Microsoft Internet Explorer 6.0 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML in corrupted images and other files such as .GIF JPG and WAV which is rendered as HTML when the user clicks on the link even though the web server response and file extension indicate that it should be treated as a different file type.


Multiple cross-site scripting (XSS) vulnerabilities in Utopia News Pro (UNP) 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the sitetitle parameter in header.php and (2) the version and (3) query_count parameters in footer.php.


Multiple cross-site scripting (XSS) vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) hex-encoded values in the QueueID parameter and (2) Action parameters.


Cross-site scripting (XSS) vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the user parameter in a profile operation a different vulnerability than CVE-2005-2814. NOTE: it is possible that this XSS is a resultant vulnerability of CVE-2005-3307.


Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the loc parameter to (1) modcp/index.php or (2) admincp/index.php or the ip parameter to (3) modcp/user.php or (4) admincp/usertitle.php.


Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance and possibly Google Search Appliance allows remote attackers to inject arbitrary Javascript and possibly other web script or HTML via a proxystylesheet variable that contains a malicious XSLT style sheet.


Cross-site scripting (XSS) vulnerability in PHP Handicapper allows remote attackers to inject arbitrary web script or HTML via the msg parameter to msg.php. NOTE: some sources identify a second vector in the login parameter to process_signup.php but the original source says that it is for CRLF injection (CVE-2005-4712). Also note: the vendor has disputed CVE-2005-3497 and it is possible that the dispute was intended to include this issue as well. If so followup investigation strongly suggests that the original report is correct.


Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.17 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) error_msg parameter to usercp_register.php (2) forward_page parameter to login.php and (3) list_cat parameter to search.php which are not initialized as variables.


Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter to css.php (2) redirect parameter to index.php (3) email parameter to user.php (4) goto parameter to language.php (5) orderby parameter to modlog.php and the (6) hex (7) rgb or (8) expandset parameter to template.php.


Rockliffe MailSite Express before 6.1.22 with the option to save login information enabled saves user passwords in plaintext in cookies which allows local users to obtain passwords by reading the cookie file or remote attackers to obtain the cookies via cross-site scripting (XSS) vulnerabilities.


Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string which is not properly quoted or filtered when the request handler generates an error message.


Cross-site scripting (XSS) vulnerability in iSQL*Plus (iSQLPlus) in Oracle9i Database Server Release 2 9.0.2.4 allows remote attackers to inject arbitrary web script or HTML via script in the \set markup HTML TABLE\ command which is executed when the user selects a table.


Multiple cross-site scripting (XSS) vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) gzip/tar and (2) css MIME viewers which do not filter or escape dangerous HTML when extracting and displaying attachments.


Cross-site scripting (XSS) vulnerability in Cisco IOS Web Server for IOS 12.0(2a) allows remote attackers to inject arbitrary web script or HTML by (1) packets containing HTML that an administrator views via an HTTP interface to the contents of memory buffers as demonstrated by the URI /level/15/exec/-/buffers/assigned/dump; or (2) sending the router Cisco Discovery Protocol (CDP) packets with HTML payload that an administrator views via the CDP status pages. NOTE: these vectors were originally reported as being associated with the dump and packet options in /level/15/exec/-/show/buffers.


Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to inject arbitrary web script or HTML via (1) the Err parameter in admin/index.php and the (2) firstname and (3) lastname parameters in index.php.


Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.4.9 allow remote attackers to inject arbitrary web script or HTML via (1) <math> tags or (2) Extension or <nowiki> sections that \bypass HTML style attribute restrictions\ that are intended to protect against XSS vulnerabilities in Internet Explorer clients.


Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via (1) the sap-syscmd in sap-syscmd and (2) the BspApplication field in the SYSTEM PUBLIC test application.


Cross-site scripting (XSS) vulnerability in gui/errordocs/index.php in Virtual Hosting Control System (VHCS) 2.2.0 through 2.4.6.2 allows remote attackers to inject arbitrary web script or HTML via query strings that are included in an error message as demonstrated using a parameter containing script.


Cross-site scripting (XSS) vulnerability in index.php in Flyspray 0.9.7 through 0.9.8 (devel) allows remote attackers to inject arbitrary web script or HTML via the (1) PHPSESSID (2) task (3) string (4) type (5) serv (6) due (7) dev and (8) sort2 parameters.


Multiple cross-site scripting (XSS) vulnerabilities in MyBulletinBoard (MyBB) 1.0 PR2 Rev 686 allow remote attackers to inject arbitrary web script or HTML via (1) the subject field when creating a new thread and (2) information passed to the Reputation system.


Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) various input fields including the contact lead and first or last name fields (2) the record parameter in a DetailView action in the Leads module for index.php (3) the $_SERVER'PHP_SELF' variable which is used in multiple locations such as index.php and (4) aggregated RSS feeds in the RSS aggregation module.


Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1 as used in (a) blogBuddiesv 0.3 (b) Jaws 0.6.2 and possibly other products allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (2) rss_url parameter to (b) magpie_slashbox.php and (c) simple_smarty.php.


Multiple cross-site scripting (XSS) vulnerabilities in FreeWebStat 1.0 rev37 allow remote attackers to inject arbitrary web script or HTML via the (1) site (2) jsref (3) jsres and (4) jscolor parameters to pixel.php which are not sanitized before being included in the logdb.html file and (5) the search key to stat.php.


Cross-site scripting (XSS) vulnerability in bug_actiongroup_page.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the summary of the bug which is not quoted when view_all_bug_page.php is used to delete the bug as identified by bug#0006002 a different vulnerability than CVE-2005-2557.


Incomplete blacklist vulnerability in MediaWiki before 1.4.11 does not properly remove certain CSS inputs (HTML inline style attributes) that are processed as active content by Internet Explorer which allows remote attackers to conduct cross-site scripting (XSS) attacks.


Cross-site scripting (XSS) vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) adsess (2) name and (3) description parameters in admin.php and the (4) ACP Notes (5) Member Name (6) Password (7) Email Address (8) Components and multiple other input fields.


Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the redir parameter to (1) cart.php or (2) index.php or (3) the searchStr parameter in a viewCat action to index.php. Note: vectors (1) and (2) were later reported to affect 3.0.7-pl1.


Multiple cross-site scripting (XSS) vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) comment parameter in detail.php (3) the username parameter in get.php and (4) the search parameter in index.php.


Multiple cross-site scripting (XSS) vulnerabilities in HTTPTranslatorServlet in Idetix Software Systems Revize CMS allow remote attackers to inject arbitrary web script or HTML via the (1) resourcetype (2) objectmap and (3) redirect parameters possibly involving setWebSpace.jsp.