IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133121.


IBM DOORS Next Generation (DNG/RRC) 6.0.2 and 6.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125459.


\HCL iNotes is susceptible to a Cross-Site Scripting (XSS) Vulnerability. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.\


IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137036.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131778.


IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128172.


IBM Jazz Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120656.


IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121418.


IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127478.


IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132851.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124752.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125724.


IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 135546.


IBM RELM 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126862.


IBM WebSphere Application Server 7.0 8.0 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127151.


IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128109.


IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133127.


IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 6.0.x) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133268.


IBM Content Navigator & CMIS 2.0 and 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124760.


IBM Daeja ViewONE Professional Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123849.


IBM Security Guardium 10.0 Database Activity Monitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132613.


IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124356.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125729.


IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131289.


IBM Content Navigator & CMIS 2.0.3 3.0.0 and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129577.


IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123913.


IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132368.


IBM Security Access Manager Appliance 9.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130675.


IBM QRadar Network Security 5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128376.


IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126524.


IBM WebSphere Portal and Web Content Manager 7.0 8.0 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125457.


IBM DOORS next Generation (DNG/RRC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123188.


IBM Rational Team Concert (RTC) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121151.


IBM DOORS Next Generation (DNG/RRC) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131759.


IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126234.


IBM Security Guardium 10.0 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124678


IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0 5.0. and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 126858.


IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128461.


IBM Cognos TM1 10.2 and 10.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129617.


IBM RELM 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127587.


IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126681.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132928.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131764.


IBM Connections Engagement Center 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134005.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133088.


IBM InfoSphere Streams 4.0 4.1 and 4.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127632.


IBM WebSphere Application Server 7.0 8.0 8.5 and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response once the URL is clicked. This would allow the attacker to perform further attacks such as Web cache poisoning cross-site scripting and possibly obtain sensitive information. IBM X-Force ID: 129578.


IBM InfoSphere Master Data Management Server 10.0 11.0 11.3 11.4 11.5 and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123674.


IBM DOORS 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130411.


IBM Sterling B2B Integrator Standard Edition 5.2.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128694.


IBM Rational Engineering Lifecycle Manager 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123187.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131760.


IBM Curam Social Program Management 6.0.5 6.1.1 6.2.0 7.0.1 and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134922.


IBM Tivoli Key Lifecycle Manager 2.5 2.6 and 2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133640.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134796.


IBM RELM 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126857.


IBM Support Tools for Lotus WCM (IBM WebSphere Portal 7.0 8.0 8.5 and 9.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130733.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125154.


IBM Quality Manager (RQM) 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132929.


IBM Connections 4.0 4.5 5.0 5.5 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134004.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131765.


IBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response once the URL is clicked. This would allow the attacker to perform further attacks such as Web cache poisoning cross-site scripting and possibly obtain sensitive information. IBM X-Force ID: 124737.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125460.


IBM Rational DOORS Next Generation 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM WebSphere Portal and Web Content Manager 6.1 7.0 and 8.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123558.


IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.0.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 122892.


IBM DOORS Next Generation (DNG/RRC) 5.0 5.0.1 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137035.


IBM Content Navigator & CMIS 2.0.3 3.0.0 and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129832.


IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128171.


IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130808.


IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127477.


IBM QRadar 7.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999534.


IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123430.


IBM RELM 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126686.


IBM DOORS Next Generation (DNG/RRC) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124751.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125723.


IBM Cognos Business Intelligence 10.2 10.2.1 10.2.1.1 and 10.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128624.


IBM WebSphere Portal 7.0 8.0 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136005.


IBM DOORS Next Generation (DNG/RRC) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124627.


IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 135523.


IBM Quality Manager (RQM) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120663.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133263.


IBM Insights Foundation for Energy 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126460.


IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123036.


IBM Maximo Asset Management 7.1 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123778.


IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126062.


IBM Curam Social Program Management 5.2 6.0 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120744.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125728.


IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128620.


Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the affected interface or hijack a valid session ID from a user of the affected interface. Cisco Bug IDs: CSCvf71978 CSCvf71986.


In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5 HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with \DEBUG = True\ (which makes this page accessible) in your production settings.


Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters redirect a user to a malicious website inject malicious content into a DCNM client interface or conduct a cross-site scripting (XSS) attack against a user of the affected software. Cisco Bug IDs: CSCvf40477 CSCvf63150 CSCvf68218 CSCvf68235 CSCvf68247.


Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163.


Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack or redirect a user of the affected service to an undesired web page. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected service. An attacker could exploit these vulnerabilities by persuading a user to click a malicious link or by sending an HTTP request that could cause the affected service to redirect the request to a specified malicious URL. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web interface of the affected system or allow the attacker to access sensitive browser-based information on the affected system. These types of exploits could also be used in phishing attacks that send users to malicious websites without their knowledge. Cisco Bug IDs: CSCve77195 CSCve90978 CSCvf42310 CSCvf42703 CSCvf42723 CSCvf46169 CSCvf49999.


A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvc50771.


A vulnerability in the web-based management interface of Cisco Jabber for Windows Mac Android and iOS could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf79080 CSCvf79088.


Cross-site scripting (XSS) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18 7.0.x before 7.0.17 7.1.x before 7.1.12 and 8.0.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper request parameter validation.


Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2 6.4.x before 6.4.6 and 6.3.x before 6.3.9 and Splunk Light before 6.5.2 with exploitation requiring administrative access aka SPL-134104.


A vulnerability in the Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to conduct a HTTP response splitting attack. The vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers controlling the response body or splitting the response into multiple responses. An exploit could allow the attacker to perform cross-site scripting attacks cross-user defacement web cache poisoning and similar exploits. Cisco Bug IDs: CSCvf16705.


A vulnerability in the web-based management interface of Cisco Unified Contact Center Express could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf09173.


A vulnerability in the web-based management interface of Cisco Jabber for Windows Mac Android and iOS could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf50378 CSCvg56018.


A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device aka HREF XSS. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. The vulnerability exists in the Cisco Adaptive Security Appliance (ASA) Software when the WEBVPN feature is enabled. Cisco Bug IDs: CSCve91068.


A vulnerability in the IOS daemon (IOSd) web-based management interface of Cisco IOS and IOS XE Software could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the web-based management interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf60862.


A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf79346.


An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00 ERAC00 ETA2 ETLS00 MODi00 and DNPi00. The integrated web server (port 80/tcp) of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into clicking on a malicious link.


A reflected Cross-Site Scripting(XSS) vulnerability in ArcSight ESM and ArcSight ESM Express any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1 allows for unintended information when a specific URL is sent to the system.


DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.


A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link.


An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the \HelpViewer\ component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML by bypassing the Same Origin Policy for quarantined HTML documents.


Ubiquiti UCRM versions 2.5.0 to 2.7.7 are vulnerable to Stored Cross-site Scripting. Due to the lack sanitization it is possible to inject arbitrary HTML code by manipulating the uploaded filename. Successful exploitation requires valid credentials to an account with \Edit\ access to \Scheduling\.


html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.


Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016 and Update 12 and earlier versions for ColdFusion 11.


Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server due to how SharePoint Server sanitizes web requests aka \Microsoft Office SharePoint XSS Vulnerability\. This CVE ID is unique from CVE-2017-11775 and CVE-2017-11777.


Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server due to how SharePoint Server sanitizes web requests aka \Microsoft Office SharePoint XSS Vulnerability\. This CVE ID is unique from CVE-2017-11775 and CVE-2017-11820.


Cross-site scripting (XSS) vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject arbitrary web script or HTML into some web applications via the upload and display of crafted text markdown or rst files that are designed to be viewed in the browser as plain text but that will be converted to HTML without proper sanitization.


Multiple Reflective cross-site scripting (XSS) vulnerabilities in search and display of event data in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML as demonstrated by the fName parameter.


NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to stored cross-site scripting attacks. Creating an SSID with an XSS payload results in successful exploitation.


An issue was discovered in Adobe Experience Manager 6.3 6.2 6.1 6.0. A cross-site scripting vulnerability in Apache Sling Servlets Post 2.3.20 has been resolved in Adobe Experience Manager.


Multiple Persistent cross-site scripting (XSS) vulnerabilities in Event log parsing and Display functions in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML via syslog.


Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to the main page; the (2) beanReference parameter to the JavaBean viewer page; or the (3) pyTableName to the System database schema modification page.


Wolf CMS 0.8.3.1 allows Cross-Site Scripting (XSS) attacks. The vulnerability exists due to insufficient sanitization of the file name in a \create-file-popup\ action and the directory name in a \create-directory-popup\ action in the HTTP POST method to the \/plugin/file_manager/\ script (aka an /admin/plugin/file_manager/browse// URI).


Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server due to how SharePoint Server sanitizes web requests aka \Microsoft Office SharePoint XSS Vulnerability\. This CVE ID is unique from CVE-2017-11777 and CVE-2017-11820.


Adobe Acrobat Chrome extension version 15.1.0.3 and earlier have a DOM-based cross-site scripting vulnerability. Successful exploitation could lead to JavaScript code execution.


Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. The vulnerabilities could potentially be exploited to allow stored cross-site scripting which could allow a hacker to execute scripts in a user's browser.


A non-privileged user of the Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-Site Scripting (XSS) attack potentially resulting in obtaining administrative permissions.


Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability in the integrated web server at port 10000/TCP which is prone to reflected Cross-Site Scripting attacks if an unsuspecting user is induced to click on a malicious link.


Cross-site scripting vulnerability in Captcha prior to version 4.3.0 Car Rental prior to version 1.0.5 Contact Form Multi prior to version 1.2.1 Contact Form prior to version 4.0.6 Contact Form to DB prior to version 1.5.7 Custom Admin Page prior to version 0.1.2 Custom Fields Search prior to version 1.3.2 Custom Search prior to version 1.36 Donate prior to version 2.1.1 Email Queue prior to version 1.1.2 Error Log Viewer prior to version 1.0.6 Facebook Button prior to version 2.54 Featured Posts prior to version 1.0.1 Gallery Categories prior to version 1.0.9 Gallery prior to version 4.5.0 Google +1 prior to version 1.3.4 Google AdSense prior to version 1.44 Google Analytics prior to version 1.7.1 Google Captcha (reCAPTCHA) prior to version 1.28 Google Maps prior to version 1.3.6 Google Shortlink prior to version 1.5.3 Google Sitemap prior to version 3.0.8 Htaccess prior to version 1.7.6 Job Board prior to version 1.1.3 Latest Posts prior to version 0.3 Limit Attempts prior to version 1.1.8 LinkedIn prior to version 1.0.5 Multilanguage prior to version 1.2.2 PDF & Print prior to version 1.9.4 Pagination prior to version 1.0.7 Pinterest prior to version 1.0.5 Popular Posts prior to version 1.0.5 Portfolio prior to version 2.4 Post to CSV prior to version 1.3.1 Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1 Quotes and Tips prior to version 1.32 Re-attacher prior to version 1.0.9 Realty prior to version 1.1.0 Relevant - Related Posts prior to version 1.2.0 Sender prior to version 1.2.1 SMTP prior to version 1.1.0 Social Buttons Pack prior to version 1.1.1 Subscriber prior to version 1.3.5 Testimonials prior to version 0.1.9 Timesheet prior to version 0.1.5 Twitter Button prior to version 2.55 User Role prior to version 1.5.6 Updater prior to version 1.35 Visitors Online prior to version 1.0.0 and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.


A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute.


Adobe Campaign versions 16.4 Build 8724 and earlier have a cross-site scripting (XSS) vulnerability.


ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.


jenkins before versions 2.44 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users or users with SCM access could configure jobs or modify build scripts such that they print serialized console notes that perform cross-site scripting attacks on Jenkins users viewing the build logs.


Adobe ColdFusion 2016 Update 3 and earlier ColdFusion 11 update 11 and earlier ColdFusion 10 Update 22 and earlier have a reflected cross-site scripting vulnerability.


A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated remote attacker to mount XSS attacks against a user of an affected device. More Information: CSCvb97237. Known Affected Releases: 11.0(1.10000.10) 11.5(1.10000.6). Known Fixed Releases: 11.5(1.12029.1) 11.5(1.12900.11) 12.0(0.98000.369) 12.0(0.98000.370) 12.0(0.98000.398) 12.0(0.98000.457).


A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected system. More Information: CSCuw63001 CSCuw63003. Known Affected Releases: 2.2(2). Known Fixed Releases: 3.1(0.0).


A reflected cross-site scripting vulnerability in the BlackBerry WatchDox Server components Appliance-X version 1.8.1 and earlier and vAPP versions 4.6.0 to 5.4.1 allows remote attackers to execute script commands in the context of the affected browser by persuading a user to click an attacker-supplied malicious link.


A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This vulnerability affects Cisco Unified Communications Manager with a default configuration running an affected software release with the attacker authenticated as the administrative user. More Information: CSCvc83712. Known Affected Releases: 12.0(0.98000.452). Known Fixed Releases: 12.0(0.98000.750) 12.0(0.98000.708) 12.0(0.98000.707) 12.0(0.98000.704) 12.0(0.98000.554) 12.0(0.98000.546) 12.0(0.98000.543) 12.0(0.98000.248) 12.0(0.98000.244) 12.0(0.98000.242).


Adobe Connect versions 9.6.1 and earlier have a reflected cross-site scripting vulnerability. Successful exploitation could lead to a reflected cross-site scripting attack.


Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality.


A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an authenticated remote attacker to perform a cross-site scripting (XSS) attack. More Information: CSCvb70033. Known Affected Releases: 11.5(1.11007.2). Known Fixed Releases: 12.0(0.98000.507) 11.0(1.23900.5) 11.0(1.23900.3) 10.5(2.15900.2).


In Apache Brooklyn before 0.10.0 the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to be a proof-of-concept exploit using this vulnerability.


A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0 11.1 and 11.5 are vulnerable. Cisco Prime Collaboration Assurance software versions prior to 11.0 are not vulnerable. More Information: CSCvc77783. Known Affected Releases: 11.5(0).


A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc44344. Known Affected Releases: 6.0(0.0).


Adobe Connect versions 9.6.1 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to a stored cross-site scripting attack.


The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.


A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvc20679. Known Affected Releases: 12.0(0.99000.9). Known Fixed Releases: 12.0(0.98000.176) 12.0(0.98000.414) 12.0(0.98000.531) 12.0(0.98000.536) 12.0(0.98000.6) 12.0(0.98500.8).


Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The products and versions that are affected include the following: TIBCO Silver Fabric Enabler for Spotfire Web Player 2.1.2 and earlier TIBCO Spotfire Analyst 7.5.0 TIBCO Spotfire Analyst 7.6.0 TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Analytics Platform for AWS Marketplace 7.0.2 and earlier TIBCO Spotfire Automation Services 6.5.3 and earlier TIBCO Spotfire Automation Services 7.0.0 and 7.0.1 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 6.5.3 and earlier TIBCO Spotfire Deployment Kit 7.0.0 and 7.0.1 TIBCO Spotfire Deployment Kit 7.5.0 TIBCO Spotfire Deployment Kit 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 6.5.2 and earlier TIBCO Spotfire Desktop 7.0.0 and 7.0.1 TIBCO Spotfire Desktop 7.5.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.0.1 and earlier TIBCO Spotfire Desktop Language Packs 7.5.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 TIBCO Spotfire Professional 6.5.3 and earlier TIBCO Spotfire Professional 7.0.0 and 7.0.1 TIBCO Spotfire Web Player 6.5.3 and earlier TIBCO Spotfire Web Player 7.0.0 and 7.0.1


A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected software. More Information: CSCvb95951. Known Affected Releases: 12.0(0.99999.2). Known Fixed Releases: 11.0(1.23064.1) 11.5(1.12031.1) 11.5(1.12900.21) 11.5(1.12900.7) 11.5(1.12900.8) 11.6(1.10000.4) 12.0(0.98000.155) 12.0(0.98000.178) 12.0(0.98000.366) 12.0(0.98000.367) 12.0(0.98000.468) 12.0(0.98000.469) 12.0(0.98000.536) 12.0(0.98000.6) 12.0(0.98500.6).


A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. More Information: CSCvc72741. Known Affected Releases: 6.2.1.


A vulnerability in the serviceability page of Cisco Unified Communications Manager could allow an unauthenticated remote attacker to conduct reflected cross-site scripting (XSS) attacks. More Information: CSCvc49348. Known Affected Releases: 10.5(2.14076.1). Known Fixed Releases: 12.0(0.98000.209) 12.0(0.98000.478) 12.0(0.98000.609).


A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated remote attacker to conduct XSS attacks against a user of an affected device. More Information: CSCvc21620. Known Affected Releases: 10.5(2.14076.1). Known Fixed Releases: 12.0(0.98000.641) 12.0(0.98000.500) 12.0(0.98000.219).


A vulnerability in the web framework code of Cisco Prime Service Catalog could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCvc79842 CSCvc79846 CSCvc79855 CSCvc79873 CSCvc79882 CSCvc79891. Known Affected Releases: 11.1.2.


A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc30999. Known Affected Releases: 12.0(0.98000.280). Known Fixed Releases: 11.0(1.23900.3) 12.0(0.98000.180) 12.0(0.98000.422) 12.0(0.98000.541) 12.0(0.98000.6).


An issue was discovered in Adobe Experience Manager 6.3 6.2 6.1 6.0. Adobe Experience Manager has a reflected cross-site scripting vulnerability in the HtmlRendererServlet.


Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes.


A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvb98777. Known Affected Releases: 11.0(1.10000.10) 11.5(1.10000.6). Known Fixed Releases: 11.0(1.23063.1) 11.5(1.12029.1) 11.5(1.12900.11) 11.5(1.12900.21) 11.6(1.10000.4) 12.0(0.98000.156) 12.0(0.98000.178) 12.0(0.98000.369) 12.0(0.98000.470) 12.0(0.98000.536) 12.0(0.98000.6) 12.0(0.98500.6).


Adobe RoboHelp has a cross-site scripting (XSS) vulnerability. This affects versions before RH12.0.4.460 and RH2017 before RH2017.0.2.


A vulnerability in Cisco Secure Access Control System (ACS) could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCvc04838. Known Affected Releases: 5.8(2.5).


Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3) CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Lutim before 0.8 might allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in an upload notification and in the myfiles component if the attacker can convince the victim to proceed with an upload despite the appearance of an XSS payload in the filename.


A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 5.6.0 to 5.6.7 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Kaltura

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

partnerId

or

playerVersion

parameter

to

the

partnerId

playerVersion

secret

entryId

adminUiConfId

or

uiConfId

parameter

to

the

streamUsername

streamPassword

streamRemoteId

streamRemoteBackupId

or

entryId

parameter

to

the

entryId

parameter

to

or

the

partnerId

or

playerVersion

parameter

to


Cross-Site

Scripting

(XSS)

was

discovered

in

ATutor

before

The

vulnerability

exists

due

to

insufficient

filtration

of

data

(url

in

An

attacker

could

inject

arbitrary

HTML

and

script

code

into

a

browser

in

the

context

of

the

vulnerable

website.


The web user interface of Dell 2335dn and 2355dn Multifunction Laser Printers firmware versions prior to V2.70.06.26 A13 and V2.70.45.34 A10 respectively are affected by a cross-site scripting vulnerability. Attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context of the affected website.


An issue was discovered in SugarCRM before 7.7.2.3 7.8.x before 7.8.2.2 and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.


EMC RSA Authentication Manager 8.2 SP1 P4 and earlier contains a reflected cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.


OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Cross-Site Scripting: /xAdmin/html/Deployment (cat_id).


An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. There are multiple reflected Cross-Site Scripting (XSS) issues in Matrix WYSIWYG plugins.


RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting vulnerabilities via certain RSA Archer Help pages. Attackers could potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.


In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8 a web server error page in VNX Control Station is impacted by a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to execute arbitrary HTML code in the user's browser session in the context of the affected web application.


A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP ArcSight ESM Express in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow Reflected and Stored Cross-Site Scripting (XSS)


Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Dolibarr

ERP/CRM

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

CompanyName

CompanyAddress

CompanyZip

CompanyTown

Fax

EMail

Web

ManagingDirectors

Note

Capital

or

parameter

to


IDenticard Two-Reader Controller Configuration Manager 1.18.8 (396) is vulnerable to Stored Cross-Site Scripting (XSS) via the notes field in /~user_handler?file=logged_in.shtm (aka the edit user page).


RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Source Asset ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.


All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to improper external user-input validation. An attacker with access to the web interface is able to hijack sessions or navigate victims outside of SiteOmat to a malicious server owned by him.


A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into the login page.


EMC RSA Authentication Manager before 8.2 SP1 P6 has a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.


OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Cross-Site Scripting: /xAdmin/html/XPressoDoc parameter: categoryId.


RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting via the request URL. Attackers could potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.


A stored Cross-site Scripting (XSS) vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0 5.7.1 and earlier allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import.


A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier 5.2.0 through 5.2.9 and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests.


Multiple

Cross-Site

Scripting

(XSS)

were

discovered

in

Gazelle

before

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(torrents

size)

passed

to

the

'Gazelle-master/sections/tools/managers/multiple_freeleech.php'

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2 430.1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link not the normal page.


Multiple

Cross-Site

Scripting

(XSS)

were

discovered

in

'openeclass

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

user)

passed

to

the

'openeclass-master/modules/tc/webconf/webconf.php'

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting (XSS) attacks within the Admin UI as demonstrated by a crafted Managed Object Name.


A Cross-Site Scripting (XSS) was discovered in imdbphp 5.1.1. The vulnerability exists due to insufficient filtration of user-supplied data (name) passed to the \imdbphp-master/demo/search.php\ URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.


A

Cross-Site

Scripting

(XSS)

was

discovered

in

'Magmi

The

vulnerability

exists

due

to

insufficient

filtration

of

user-supplied

data

(prefix)

passed

to

the

'magmi-git-master/magmi/web/ajax_gettime.php'

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A

Cross-Site

Scripting

(XSS)

was

discovered

in

'wallacepos

The

vulnerability

exists

due

to

insufficient

filtration

of

user-supplied

data

(token)

passed

to

the

'wallacepos-master/myaccount/resetpassword.php'

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A Cross-Site Scripting (XSS) was discovered in GamePanelX-V3 3.0.12. The vulnerability exists due to insufficient filtration of user-supplied data (a) passed to the \GamePanelX-V3-master/ajax/ajax.php\ URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.


OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI as demonstrated by the _sortKeys parameter to the authzRoles script under managed/user/.


JavaScript in the \about:webrtc\ page is not sanitized properly being assigned to \innerHTML\. Data on this page is supplied by WebRTC usage and is not under third-party control making this difficult to exploit but the vulnerability could possibly be used for a cross-site scripting (XSS) attack. This vulnerability affects Firefox < 55.


A

Cross-Site

Scripting

(XSS)

was

discovered

in

'SocialNetwork

The

vulnerability

exists

due

to

insufficient

filtration

of

user-supplied

data

(mail)

passed

to

the

'SocialNetwork-andrea/app/template/pw_forgot.php'

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


Multiple

Cross-Site

Scripting

(XSS)

were

discovered

in

admin/modules

components

in

SLiMS

Cendana

through

the

keywords

parameter

to

bibliography/item.php

and

and

the

quickReturnID

field

to


Reflected and stored Cross-Site Scripting (XSS CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier 2.3 Update 1 before Hotfix 8 and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features.


Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse.


The content security policy (CSP) \sandbox\ directive did not create a unique origin for the document causing it to behave as if the \allow-same-origin\ keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56 Firefox ESR < 52.4 and Thunderbird < 52.4.


A

Cross-Site

Scripting

(XSS)

was

discovered

in

Gazelle

before

The

vulnerability

exists

due

to

insufficient

filtration

of

user-supplied

data

(type)

passed

to

the

'Gazelle-master/sections/better/transcode.php'

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A

Cross-Site

Scripting

(XSS)

was

discovered

in

ZoneMinder

before

The

vulnerability

exists

due

to

insufficient

filtration

of

user-supplied

data

(postLoginQuery)

passed

to

the

\ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A

Cross-Site

Scripting

(XSS)

was

discovered

in

Gazelle

before

The

vulnerability

exists

due

to

insufficient

filtration

of

user-supplied

data

(action)

passed

to

the

'Gazelle-master/sections/tools/finances/bitcoin_balance.php'

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page used in My View (my_view_page.php) and User Information (view_user_page.php) pages allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL due to use of unsanitized $_SERVER'PHP_SELF' to generate URLs.


An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the \WebKit\ component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via crafted web content that incorrectly interacts with the Application Cache policy.


A reflected Cross-site Scripting (XSS) vulnerability in web proxy disclaimer response web pages in Fortinet FortiOS 5.6.0 5.4.0 to 5.4.5 5.2.0 to 5.2.11 allows an unauthenticated attacker to inject arbitrary web script or HTML in the context of the victim's browser via sending a maliciously crafted URL to the victim.


A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'window_title' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e. administrator access rights) or altering the system configuration file (config_inc.php).


Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11 when development mode is used allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.


A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9 2.1.3 and 2.2.3.


A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9 2.1.3 and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed as recommended in the \Post-installation and upgrade tasks\ of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.


Reflected and stored Cross-Site Scripting (XSS CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3 2.3 Update 1 before Hotfix 8 and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features if this component is configured. Note esfadmingui is not enabled by default.


Multiple cross-site scripting (XSS) vulnerabilities in Gespage before 7.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) printer name when adding a printer in the admin panel or (2) username parameter to webapp/users/user_reg.jsp.


Multiple

Cross-Site

Scripting

(XSS)

were

discovered

in

SLiMS

Cendana

before

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(id)

passed

to

the

'slims7_cendana-master/template/default/detail_template.php'

and

'slims7_cendana-master/template/default-rtl/detail_template.php'

URLs.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


Multiple

Cross-Site

Scripting

(XSS)

were

discovered

in

Gazelle

before

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(action

userid)

passed

to

the

'Gazelle-master/sections/tools/data/ocelot_info.php'

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A \data:\ URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page allowing for bypasses of the policy including the execution of JavaScript. In prior versions when \data:\ documents also inherited the context of the original page this would allow for potential cross-site scripting (XSS) attacks. This vulnerability affects Firefox < 57.


A Cross-Site Scripting (XSS) vulnerability in Fortinet FortiWLC 6.1-x (6.1-2 6.1-4 and 6.1-5); 7.0-x (7.0-7 7.0-8 7.0-9 7.0-10); and 8.x (8.0 8.1 8.2 and 8.3.0-8.3.2) allows an authenticated user to inject arbitrary web script or HTML via non-sanitized parameters \refresh\ and \branchtotable\ present in HTTP POST requests.


A

Cross-Site

Scripting

(XSS)

was

discovered

in

pi-engine/pi

The

vulnerability

exists

due

to

insufficient

filtration

of

user-supplied

data

(preview)

passed

to

the

\pi-develop/www/script/editor/markitup/preview/markdown.php\

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected device related to the Guest Portal. More Information: CSCvd74794. Known Affected Releases: 1.3(0.909) 2.1(0.800).


A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device aka Message Tracking XSS. More Information: CSCvd30805 CSCvd34861. Known Affected Releases: 10.0.0-203 10.1.0-049.


A

Cross-Site

Scripting

(XSS)

issue

was

discovered

in

webpagetest

The

vulnerability

exists

due

to

insufficient

filtration

of

user-supplied

data

(video)

passed

to

the

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

INTER-Mediator

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(c

and

cred)

passed

to

the

\INTER-Mediator-master/Auth_Support/PasswordReset/resetpassword.php\

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A vulnerability in the web application interface of the Cisco Identity Services Engine (ISE) portal could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvd49141. Known Affected Releases: 2.1(102.101).


A vulnerability in the web-based management interface of Cisco Unified Communications Manager 10.5 through 11.5 could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvc06608.


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

EPESI

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(cid

value

element

mode

tab

id)

passed

to

the

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

EPESI

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(visible

tab

cid)

passed

to

the

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A vulnerability in the web framework code of Cisco Prime Infrastructure could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCuw65843. Known Affected Releases: 3.1(0.0).


A Cross-Site Scripting (XSS) issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data (pssid) passed to the webpagetest-master/www/pss.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.


A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. Affected Products: Cisco Firepower Management Center Releases 5.4.1.x and prior. More Information: CSCuy88951. Known Affected Releases: 5.4.1.6.


A vulnerability in the web interface of Cisco Industrial Network Director could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against an affected system. More Information: CSCvd25405. Known Affected Releases: 1.1(0.176).


A vulnerability in the web framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by convincing a user to access a malicious link or by intercepting a user request and injecting malicious code into the request. An exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvd76324. Known Affected Releases: 2.2(9.76) and 2.3(1).


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

EPESI

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

callback

args

cid)

passed

to

the

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

EPESI

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(element

state

cat

id

cid)

passed

to

the

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A vulnerability in the web framework code of Cisco Prime Infrastructure could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCuw65833 CSCuw65837. Known Affected Releases: 2.2(2).


A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc24616 CSCvc35363 CSCvc49574. Known Affected Releases: 3.1(1) 2.0(4.0.45B).


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

webpagetest

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(benchmark

url)

passed

to

the

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


In WordPress before 4.7.3 (wp-admin/js/tags-box.js) there is cross-site scripting (XSS) via taxonomy term names.


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

phpipam

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

passed

to

several

pages

(instructions

in

subnetId

in

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


Cross-site

scripting

(XSS)

vulnerability

in

httpd

on

ASUS

and

routers

with

firmware

before

routers

with

firmware

before

and

and

Pro

routers

with

firmware

before

allows

remote

attackers

to

inject

arbitrary

JavaScript

by

requesting

filenames

longer

than

characters.


In

WordPress

before

there

is

authenticated

Cross-Site

Scripting

(XSS)

via

Media

File

Metadata.

This

is

demonstrated

by

both

mishandling

of

the

playlist

shortcode

in

the

function

in

wp-includes/media.php

and

mishandling

of

meta

information

in

the

renderTracks

function

in


Cross-site scripting (XSS) vulnerability in the help component of SAP BusinessObjects Financial Consolidation 10.0.0.1933 allows remote attackers to inject arbitrary web script or HTML via a GET request. /finance/help/en/frameset.htm is the URI for this component. The vendor response is SAP Security Note 2368106.


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

webpagetest

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(benchmark

time)

passed

to

the

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A vulnerability in the web-based management interface of Cisco Jabber Guest Server 10.6(9) 11.0(0) and 11.0(1) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve09718.


A Cross-Site Scripting (XSS) issue was discovered in php-calendar before 2017-03-03. The vulnerability exists due to insufficient filtration of user-supplied data (errorMsg) passed to the \php-calendar-master/error.php\ URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.


A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an unauthenticated remote attacker to conduct a Document Object Model (DOM) based (environment or client-side) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc24620 CSCvc49586. Known Affected Releases: 3.1(1) 2.0(4.0.45B).


Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.


Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1_description parameter (aka \Design Manager > Categories > Category Description\).


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

OpenEMR

and

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

passed

to

the

\openemr-master/gacl/admin/object_search.php\

URL

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A vulnerability in the web framework code of Cisco Firepower Management Center could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. Affected Products: Cisco Firepower Management Center Software Releases prior to 6.0.0.0. More Information: CSCuy88785. Known Affected Releases: 5.4.1.6.


The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow an authenticated user to perform stored Cross-Site Scripting attacks.


A Cross-Site Scripting (XSS) issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data (bgcolor) passed to the webpagetest-master/www/video/view.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.


EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document.


There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field.


A

Cross-Site

Scripting

(XSS)

issue

was

discovered

in

webpagetest

The

vulnerability

exists

due

to

insufficient

filtration

of

user-supplied

data

(benchmark)

passed

to

the

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

ATutor

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

passed

to

several

pages

in

themes/*/admin/system_preferences/language_edit.tmpl.php).

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.5(1) could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvd82064.


A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning (PCP) Tool could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvc90312. Known Affected Releases: 12.1.


A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated remote attacker to impact the integrity of the system by executing a Document Object Model (DOM)-based environment or client-side cross-site scripting (XSS) attack. The vulnerability occurs because user-supplied data in the DOM input is not validated. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious DOM statements to the affected system. A successful exploit could allow the attacker to affect the integrity of the system by manipulating the database. Known Affected Releases 11.0(1)ES10. Cisco Bug IDs: CSCvf18325.


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

webpagetest

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(benchmark

time)

passed

to

the

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

EPESI

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(state

element

id

tab

cid)

passed

to

the

\EPESI-master/modules/Utils/RecordBrowser/favorites.php\

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A vulnerability in the web framework of Cisco SocialMiner could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCve15285. Known Affected Releases: 11.5(1).


A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88865. Known Affected Releases: 10.1.0-204.


A vulnerability in the web-based application interface of the Cisco Identity Services Engine (ISE) portal could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvd87482. Known Affected Releases: 2.1(102.101) 2.2(0.283) 2.3(0.151).


In WordPress before 4.7.3 (wp-includes/embed.php) there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.


A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.1(6.11) and 9.4(1.2) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device aka WebVPN XSS. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve19179.


Multiple

Cross-Site

Scripting

(XSS)

issues

were

discovered

in

webpagetest

The

vulnerabilities

exist

due

to

insufficient

filtration

of

user-supplied

data

(configs)

passed

to

the

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A

Cross-Site

Scripting

(XSS)

issue

was

discovered

in

reasoncms

before

The

vulnerability

exists

due

to

insufficient

filtration

of

user-supplied

data

(nyroModalSel)

passed

to

the

\reasoncms-master/www/nyroModal/demoSent.php\

URL.

An

attacker

could

execute

arbitrary

HTML

and

script

code

in

a

browser

in

the

context

of

the

vulnerable

website.


A vulnerability in the web-based management interface of Cisco Finesse 10.6(1) and 11.5(1) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvd96744.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated remote attacker to conduct a reflective cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc85415. Known Affected Releases: 2.1(0.800).


A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. More Information: CSCvc38801. Known Affected Releases: 6.0.1.3 6.2.1. Known Fixed Releases: 6.2.1.


Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (url pssid) passed to the webpagetest-master/www/weblite.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.


A vulnerability in the web-based management interface of the Cisco Secure Access Control System (ACS) could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected system. More Information: CSCve70587. Known Affected Releases: 5.8(0.8) 5.8(1.5).


The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting (XSS) affecting a vanity-urls Title field a containers Description field and a templates Description field.


PRTG Network Monitor version 17.3.33.2830 is vulnerable to reflected Cross-Site Scripting on error.htm (the error page) via the errormsg parameter.


A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 where the qname of DNS queries was displayed without any escaping allowing a remote attacker to inject HTML and Javascript code into the web interface altering the content.


Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string as demonstrated by a PGP field related to prive/objets/contenu/auteur.html and ecrire/inc/texte_mini.php.


Huawei SmartCare V200R003C10 has a stored XSS (cross-site scripting) vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device.


PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all sensor titles related to incorrect error handling for a %00 in the SRC attribute of an IMG element.


Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter.


PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all group names created related to incorrect error handling for an HTML encoded script.


Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability the attacker must be first authenticated to the application. For the first one the attacker has to simply inject XSS code within the URL field of a shared item. For the second one however the attacker must prepare a payload within its profile and then ask an administrator to modify its profile. From there whenever the administrator accesses the log it can be XSS'ed.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

user-login-history

plugin

through

for

WordPress

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

username

browser

or

parameter

to


Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data (in /sources/folders.queries.php). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.


Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via (1) COMMAND (2) COMMANDS INSTRUCTION or (3) DESCRIPTION parameter.


Cross-site

scripting

(XSS)

vulnerability

in

Umbraco

CMS

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

\page

name\

(aka

nodename)

parameter

during

the

creation

of

a

new

page

related

to

and


Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19 7.0.x before 7.0.19 7.1.x before 7.1.14 and 8.0.x before 8.0.7 when the GlobalProtect gateway or portal is configured allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425) allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin it causes JavaScript execution in the context of the Admin account.


The ESXi Host Client in VMware ESXi (6.5 before ESXi650-201712103-SG 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker can exploit this vulnerability by injecting Javascript which might get executed when other users access the Host Client.


VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page.