Cross-site

scripting

(XSS)

vulnerability

in

install/forum_data/src/custom_fields.inc.t

in

FUDforum

and

earlier

when

registering

a

new

user

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

custom

profile

field

to

index.php.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management Maximo Asset Management Essentials Maximo for Government Maximo for Nuclear Power Maximo for Transportation Maximo for Life Sciences Maximo for Oil and Gas and Maximo for Utilities 7.1.x through 7.1.1.12 7.1.2 7.5 before 7.5.0.3 IFIX014 and 7.5.0.5 before IFIX003; SmartCloud Control Desk (SCCD) 7.5 before 7.5.0.3 IFIX014 and 7.5.0.5 before IFIX003; and Tivoli Asset Management for IT Tivoli Service Request Manager Maximo Service Desk and Change and Configuration Management Database (CCMDB) 7.1.x through 7.1.1.12 7.1.2 and 7.2.x through 7.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in workingSet.jsp in IBM Eclipse Help System (IEHS) as used in the installable InfoCenter component in IBM FileNet Content Manager 4.5.1 5.0.0 5.1.0 and 5.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer 2.1.3 when used as a component for Joomla! allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) application.js.php in scripts/ or (2) admin.php (3) copy_move.php (4) functions.php (5) header.php or (6) upload.php in include/.


Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 makes it easier for remote attackers to inject arbitrary web script or HTML by leveraging a Same Origin Policy violation triggered by lack of a charset parameter in a Content-Type HTTP header.


Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module as used in Serendipity before 1.7.3 and possibly other products allows remote attackers to inject arbitrary web script or HTML via the to_r_list parameter.


Multiple cross-site scripting (XSS) vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) message parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977.


Multiple cross-site scripting (XSS) vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.2 allow remote attackers to inject arbitrary web script or HTML via (1) vectors involving PHP scripts and (2) unspecified other vectors.


The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file related to the get_allowed_mime_types function in wp-includes/functions.php.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters leading to improper interaction with the Windows MHTML protocol handler.


Multiple cross-site scripting (XSS) vulnerabilities in the oraadmin service page in Cisco MediaSense allow remote attackers to inject arbitrary web script or HTML via an unspecified parameter aka Bug IDs CSCuj23320 CSCuj23324 CSCuj23333 and CSCuj23338.


Cross-site

scripting

(XSS)

vulnerability

in

in

the

Admin

Panel

in

Atlassian

JIRA

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

name

parameter

to

secure/admin/user/DeleteUser!default.jspa.


Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature related to save_identity.inc.


Cross-site scripting (XSS) vulnerability in article.php in Anchor CMS 0.9.1 when comments are enabled allows remote attackers to inject arbitrary web script or HTML via the Name field. NOTE: some sources have reported that comments.php is vulnerable but certain functions from comments.php are used by article.php.


Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16 6.22.1 before rev19 7.0.1 before rev7 7.0.2 before rev11 and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view action aka Bug ID 26373 a different vulnerability than CVE-2013-3106.


Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to (1) vulnmeter/index.php or (2) vulnmeter/sched.php; the (3) section parameter to av_inventory/task_edit.php; the (4) profile parameter to nfsen/rrdgraph.php; or the (5) scan_server or (6) targets parameter to vulnmeter/simulate.php.


The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file.


Multiple cross-site scripting (XSS) vulnerabilities in the xn function in RockMongo 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) db parameter on the login page or (2) username parameter in a login.index action to index.php and other unspecified parameters.


Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) content with the text/xml MIME type or (2) the Status comment field of an appointment.


Cross-site scripting (XSS) vulnerability in the getRecommSearch function in recommlist.php in OXID eShop before 4.6.7 Professional and Community Edition 4.7.x before 4.7.8 and Enterprise Edition 5.x before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via the searchrecomm parameter.


Cross-site scripting (XSS) vulnerability in IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.2.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to a \cross frame scripting\ attack against an administrative user.


Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod (4) TodUrlAdd parameter to urlfilter.cmd (5) appName parameter to scprttrg.cmd (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd (8) groupName parameter to portmapcfg.cmd (9) snmpRoCommunity parameter to snmpconfig.cgi (10) fltName parameter to scinflt.cmd (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd (13) ippName parameter to ippcfg.cmd (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi or (16) wlSsid parameter to wlcfg.wl.


Cross-site

scripting

(XSS)

vulnerability

in

in

phpMyAdmin

before

and

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

pageNumber

value

to


Cross-site scripting (XSS) vulnerability in the web-based interface in Juniper Junos Space before 13.1R1.6 as used on the JA1500 appliance and in other contexts allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka PR 884469.


Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart) as used in the Pretty Link Lite plugin before 1.6.3 for WordPress JNews (com_jnews) component 8.0.1 for Joomla! and CiviCRM 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote attackers to inject arbitrary web script or HTML via the get-data parameter.


Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError event.


Multiple cross-site scripting (XSS) vulnerabilities in synetics i-doit open 0.9.9-7 i-doit pro 1.0 and earlier and i-doit pro 1.0.2 when the 'sanitize user input' flag is not enabled allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the IBM Tivoli Monitoring (ITM) Java servlet container in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter aka Bug ID CSCud51068.


Multiple cross-site scripting (XSS) vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail before 4.3.4 on FortiMail Identity-Based Encryption (IBE) appliances allow user-assisted remote attackers to inject arbitrary web script or HTML via (1) the Add field for the Black List under Antispam Management User Preferences or (2) the User name field for the Personal Black/White List in the AntiSpam section.


Mozilla Firefox before 23.0 Firefox ESR 17.x before 17.0.8 Thunderbird before 17.0.8 Thunderbird ESR 17.x before 17.0.8 and SeaMonkey before 2.20 do not properly handle the interaction between FRAME elements and history which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving spoofing a relative location in a previously visited document.


Multiple cross-site scripting (XSS) vulnerabilities in editflagtypes.cgi in Bugzilla 2.x 3.x and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) sortkey parameter.


Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name (3) dbem_phone (4) user_email or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.


The XrayWrapper implementation in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 does not properly address the possibility of an XBL scope bypass resulting from non-native arguments in XBL function calls which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging access to an unprivileged object.


Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 Groove Server 2010 SP1 SharePoint Foundation 2010 SP1 and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string aka \HTML Sanitization Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in report.cgi in Bugzilla 4.1.x and 4.2.x before 4.2.7 and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report as demonstrated by the (1) summary or (2) real name field. NOTE: this issue exists because of an incomplete fix for CVE-2012-4189.


Cross-site scripting (XSS) vulnerability in the 3 slide gallery in page--front.tpl.php in the Business theme before 7.x-1.8 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.


** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettingswidth or (2) visualizationSettingsheight parameter. NOTE: a third party reports that this is \not exploitable.\


The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0 Firefox ESR 17.x before 17.0.8 Thunderbird before 17.0.8 Thunderbird ESR 17.x before 17.0.8 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

PHP-Fusion

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

highlight

parameter

to

forum/viewthread.php;

or

remote

authenticated

users

with

certain

permissions

to

inject

arbitrary

web

script

or

HTML

via

the

or

parameter

to

messages.php;

message

parameter

to

message

parameter

to

administration/news.php;

parameter

to

HTTP

User

Agent

string

to

administration/phpinfo.php;

parameter

to

administration/bbcodes.php;

errorMessage

parameter

to

or

in

administration/

when

error

is

or

body

or

parameter

to

administration/articles.php.


The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0 Firefox ESR 17.x before 17.0.6 Thunderbird before 17.0.6 and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.


The Web Workers implementation in Mozilla Firefox before 23.0 Firefox ESR 17.x before 17.0.8 Thunderbird before 17.0.8 Thunderbird ESR 17.x before 17.0.8 and SeaMonkey before 2.20 does not properly restrict XMLHttpRequest calls which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via unspecified vectors.


The

sanitize

helper

in

in

the

Action

Pack

component

in

Ruby

on

Rails

before

and

before

and

before

does

not

properly

handle

encoded

(colon)

characters

in

URLs

which

makes

it

easier

for

remote

attackers

to

conduct

cross-site

scripting

(XSS)

attacks

via

a

crafted

scheme

name

as

demonstrated

by

including

a

sequence.


Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summary_print_by_category function or (2) project name in the summary_print_by_project function.


Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8 as used in em-shorty RepRapCalculator Fulcrum Django aCMS and other products allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this is might be the same vulnerability as CVE-2013-1463. If so it is likely that CVE-2013-1463 will be REJECTed.


Multiple cross-site scripting (XSS) vulnerabilities in the management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the IBM Tivoli Monitoring (ITM) help menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter aka Bug ID CSCud54397.


Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10 2.2.x before 2.2.8 2.3.x before 2.3.5 and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.


The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0 Firefox ESR 17.x before 17.0.7 Thunderbird before 17.0.7 and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions which allows remote attackers to execute arbitrary JavaScript code with chrome privileges or conduct cross-site scripting (XSS) attacks via a crafted web site.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

glFusion

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

subject

parameter

to

profiles.php;

city

state

title

url

or

zipcode

parameter

to

calendar/index.php;

title

or

url

parameter

to

links/index.php;

or

to

admin/plugins/mediagallery/xppubwiz.php/.


Multiple cross-site scripting (XSS) vulnerabilities in the element-list implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors aka Bug IDs CSCue14517 CSCue38914 CSCue38884 CSCue38882 CSCue38881 CSCue38872 CSCue38868 CSCue38866 CSCue38853 and CSCue14540.


Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.


The

method

in

in

the

Action

Pack

component

in

Ruby

on

Rails

before

and

before

and

before

does

not

properly

handle

(newline)

characters

which

makes

it

easier

for

remote

attackers

to

conduct

cross-site

scripting

(XSS)

attacks

via

crafted

Cascading

Style

Sheets

(CSS)

token

sequences.


Mozilla Firefox before 24.0 on Android allows attackers to bypass the Same Origin Policy and consequently conduct cross-site scripting (XSS) attacks or obtain password or cookie information by using a symlink in conjunction with a file: URL for a local file.


Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Communications Domain Manager allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) IptAccountMgmt (2) IptFeatureConfigTemplateMgmt (3) IptFeatureDisplayPolicyMgmt or (4) IptProviderMgmt page aka Bug IDs CSCud69972 CSCud70193 and CSCud70261.


Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) tus/ or (2) tus/tus/.


Cross-site scripting (XSS) vulnerability in the wireless configuration module in Cisco Prime Infrastructure allows remote attackers to inject arbitrary web script or HTML via an SSID that is not properly handled during display of the XML windowing table aka Bug ID CSCuf04356.


Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish a different vulnerability than CVE-2012-6092.


Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the (1) quota parameter to /core/settings/ajax/setquota.php or remote authenticated users with group admin privileges to inject arbitrary web script or HTML via the (2) group field to settings.php or (3) \share with\ field.


CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks via the return_url parameter.


Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20 as used in ownCloud Server before 5.0.4 and other products allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters as demonstrated using document.write in the jQuery parameter a different vulnerability than CVE-2013-2022 and CVE-2013-2023.


Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to backup-edit.php; (2) title or (3) menu parameter to edit.php; or (4) path or (5) returnid parameter to filebrowser.php in admin/. NOTE: the path parameter in admin/upload.php vector is already covered by CVE-2012-6621.


Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2 as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10 allows remote attackers to inject arbitrary web script or HTML via the file parameter.


Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) new_name parameter to apps/bookmarks/ajax/renameTag.php or (2) multiple unspecified parameters to unknown files in apps/contacts/ajax/.


Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server before 6.20.7 rev14 6.22.0 before rev13 and 6.22.1 before rev14 allow remote attackers to inject arbitrary web script or HTML via (1) invalid JSON data in a mail-sending POST request (2) an arbitrary parameter to servlet/TestServlet (3) a javascript: URL in a standalone-mode action to a UWA module (4) an infostore attachment (5) JavaScript code in a contact image (6) an RSS feed or (7) a signature.


Mozilla Firefox before 23.0 Firefox ESR 17.x before 17.0.8 Thunderbird before 17.0.8 Thunderbird ESR 17.x before 17.0.8 and SeaMonkey before 2.20 use an incorrect URI within unspecified comparisons during enforcement of the Same Origin Policy which allows remote attackers to conduct cross-site scripting (XSS) attacks or install arbitrary add-ons via a crafted web site.


Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pfad parameter to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this might be the same vulnerability as CVE-2013-1808. If so it is likely that CVE-2013-1463 will be REJECTed.


Multiple cross-site scripting (XSS) vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) dir (2) item (3) order (4) searchitem (5) selitems or (6) srt parameter to index.php or (7) the QUERY_STRING to index.php.


Cross-site scripting (XSS) vulnerability in IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element in an HTML e-mail message aka SPRs JMOY95BLM6 and JMOY95BN49.


Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 7.0 before 7.0.0.29 8.0 before 8.0.0.6 and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via crafted field values.


Cross-site scripting (XSS) vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.12 6.2.1 before 6.2.1.5 and 6.2.2 before 6.2.2.4 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.12 and 6.2.1 before 6.2.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a SAML 2.0 response.


Multiple cross-site scripting (XSS) vulnerabilities in pd-admin before 4.17 allow remote authenticated users to inject arbitrary web script or HTML via (1) the WebFTP Overview \Create new directory\ field or (2) the body of an e-mail autoresponder message.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Newscoop

through

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

vectors

involving

the

language

parameter

to

or

user

parameter

to


Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 7.0 before 7.0.0.27 8.0 before 8.0.0.6 and 8.5 before 8.5.0.2 when login security is disabled allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the Varnish module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta2 for Drupal allow remote attackers to inject arbitrary web script or HTML via crafted a (1) Watchdog message or (2) admin setting.


Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) search_words parameter in a search action to wpf.class.php or (2) togroupusers parameter in an add_user_togroup action to fs-admin/fs-admin.php.


Cross-site scripting (XSS) vulnerability in EMC Smarts IP Manager Smarts Service Assurance Manager Smarts Server Manager Smarts VoIP Availability Manager Smarts Network Protocol Manager and Smarts MPLS Manager before 9.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0 1.2.1 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to pages/UI.php or (2) expression parameter to pages/run_query.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the virtual member manager (VMM) administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 7.0 before 7.0.0.27 8.0 before 8.0.0.6 and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 and 10.1 before FP1 and InfoSphere Master Data Management Server for Product Information Management 6.0 9.0 and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the (1) Accelerator JSPs (2) Organization Administration Console JSPs and (3) Administration Console JSPs in WebSphere Commerce Tools in IBM WebSphere Commerce 5.6.1.0 through 5.6.1.5 6.0.0.0 through 6.0.0.11 and 7.0.0.0 through 7.0.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05 11.04.01 and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.


Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5 4.0.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) unspecified parameters to apps/calendar/ajax/event/new.php or (2) url parameter to apps/bookmarks/ajax/addBookmark.php.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29 8.0 before 8.0.0.7 and 8.5 before 8.5.5.0 when OAuth is used allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1.0.0.1218 in Application Support Facility (ASF) 3.4 for z/OS on Windows Linux and AIX allows remote authenticated users to inject content and conduct phishing attacks via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19 when running with older versions of jQuery that are vulnerable to CVE-2011-4969 allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are used to select DOM elements.


Mozilla Firefox before 20.0 Firefox ESR 17.x before 17.0.5 Thunderbird before 17.0.5 Thunderbird ESR 17.x before 17.0.5 and SeaMonkey before 2.17 do not ensure the correctness of the address bar during history navigation which allows remote attackers to conduct cross-site scripting (XSS) attacks or phishing attacks by leveraging control over navigation timing.


ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie. NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ownCloud

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

iCalendar

file

to

the

calendar

application

the

dir

or

file

parameter

to

or

the

mountpoint

parameter

to


Cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2013-2983.


Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 7.0 before 7.0.0.27 8.0 before 8.0.0.6 and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Tivoli Enterprise Portal browser client in IBM Tivoli Monitoring 6.2.0 through FP03 6.2.1 through FP04 6.2.2 through FP09 and 6.2.3 through FP02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Rendered links formatter in the Menu Reference module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the \Administer menus and menu items\ permission to inject arbitrary web script or HTML via the menu link title.


Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2 4.0 4.0.1 4.0.2 and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message as demonstrated by the XML Firewall Multi Protocol Gateway (MPGW) Web Service Proxy and Web Token services.


Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Portal before 8.0.0.1 CF07 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Portal (2) Portal 7.0.0.2 (3) Portal 8.0 or (4) PortalWeb2 theme.


darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1 as used in Ruby does not properly generate documents which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.


Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors aka SPR PTHN95XNR3 a different vulnerability than CVE-2013-0590.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 Maximo Asset Management Essentials 7.5 and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to a uisessionid.


Cross-site scripting (XSS) vulnerability in the Web Content Manager - Web Content Viewer Portlet in the server in IBM WebSphere Portal 7.0.0.x through 7.0.0.2 CF22 and 8.0.0.x through 8.0.0.1 CF5 when the IBM Portlet API is used allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Message Broker 7.0 before 7.0.0.6 and 8.0 before 8.0.0.2 when wsdl support is enabled on a SOAPInput node allows remote attackers to inject arbitrary web script or HTML via a wsdl request that is not properly handled during construction of an error message.


Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input aka \System Center Operations Manager Web Console XSS Vulnerability \ a different vulnerability than CVE-2013-0010.


Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.0 before HF127 8.5 before HF89 9.0 before HF69 9.1.0 before FP41 and 9.2.0 before FP13 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13 3.7.x and 4.0.x before 4.0.10 4.1.x and 4.2.x before 4.2.5 and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to inject arbitrary web script or HTML via the id parameter in conjunction with an invalid value of the format parameter.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ownCloud

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

to

mime

parameter

to

or

token

parameter

to


Mozilla Firefox before 18.0 on Android and SeaMonkey before 2.15 do not restrict a touch event to a single IFRAME element which allows remote attackers to obtain sensitive information or possibly conduct cross-site scripting (XSS) attacks via a crafted HTML document.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

IBM

Business

Process

Manager

(BPM)

and

before

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

vectors

involving

teamworks/executeServiceByName

or


Cross-site scripting (XSS) vulnerability in the Manager Change for Organic Groups (og_manager_change) module 7.x-2.x before 7.x-2.1 for Drupal might allow remote attackers to inject arbitrary web script or HTML via the username in the new manager autocomplete field.


Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Information Server through 8.5 FP3 8.7 through FP2 and 9.1 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to the (1) web console and (2) repository management user interfaces.


Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1.0.0.1218 in Application Support Facility (ASF) 3.4 for z/OS on Windows Linux and AIX allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 6 through Update 38 5.0 through Update 38 and 1.4.2_40 and earlier and OpenJDK 7 allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to cross-site scripting (XSS) in the sun.rmi.transport.proxy CGIHandler class that does not properly handle error messages in a (1) command or (2) port number.


Cross-site scripting (XSS) vulnerability in the User Relationships module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-alpha5 for Drupal allows remote authenticated users with the \administer user relationships\ permission to inject arbitrary web script or HTML via a relationship name.


Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 and 10.1 before FP1 and InfoSphere Master Data Management Server for Product Information Management 6.0 9.0 and 9.1 allow remote authenticated users to inject content and conduct phishing attacks via unspecified vectors.


Cross-site scripting (XSS) vulnerability in EMC Documentum Webtop before 6.7 SP2 Documentum WDK before 6.7 SP2 Documentum Taskspace before 6.7 SP2 and Documentum Records Manager before 6.7 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services and 7.1 before 7.1.1 for Web for Apache allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Views in the Search API (search_api) module 7.x-1.x before 7.x-1.4 for Drupal when using certain backends and facets allows remote attackers to inject arbitrary web script or HTML via unspecified input which is returned in an error message.


Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors aka SPR PTHN95XNR3 a different vulnerability than CVE-2013-0591.


Multiple cross-site scripting (XSS) vulnerabilities in the Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3 6.2.1 through FP4 6.2.2 through FP9 and 6.2.3 before FP3 as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) site_name or (2) site_url parameter to apps/external/ajax/setsites.php.


Cross-site scripting (XSS) vulnerability in the NewSectionPrompt function in include/tool/editing_page.php in gpEasy CMS 3.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the section parameter in a new_section action to index.php.


Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input aka \System Center Operations Manager Web Console XSS Vulnerability \ a different vulnerability than CVE-2013-0009.


Cross-site scripting (XSS) vulnerability in the \View Log\ screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05 11.04.01 through 11.04.02 and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file which is then incorrectly interpreted as UTF-8 by Chrome and Firefox.


Multiple cross-site scripting (XSS) vulnerabilities in the Brother MFC-9970CDW printer with firmware G (1.03) allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/log_to_net.html or (2) kind parameter to fax/copy_settings.html a different vulnerability than CVE-2013-2670 and CVE-2013-2671.


Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 7.0 before 7.0.0.29 8.0 before 8.0.0.7 and 8.5 before 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Gallery

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

movie

title

to

or

key

variable

to


Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15 4.5.x before 4.5.11 and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the url parameter to (1) apps/bookmarks/ajax/addBookmark.php or (2) apps/bookmarks/ajax/editBookmark.php.


Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) xss parameter in an allow action to rss.php (2) msg parameter to end-user/errdoc.php (3) h parameter to end-user/ftp_redirect.php or (4) threat parameter to the Blocked component.


Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files (2) editing of media files (3) installation of plugins (4) updates to plugins (5) installation of themes or (6) updates to themes.


Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Physical network name to the Zone wizard; (2) New network name (3) instance name or (4) group to the Instance wizard; (5) unspecified \multi-edit fields;\ and (6) unspecified \list view\ edit fields related to global settings.


Cross-site

scripting

(XSS)

vulnerability

in

Atmail

Webmail

Server

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

to

index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<MessageID>/filenameOriginal/.


Cross-site scripting (XSS) vulnerability in the dashboard of the ArubaOS Administration WebUI in Aruba Networks ArubaOS 6.2.x before 6.2.0.3 6.1.3.x before 6.1.3.7 6.1.x-FIPS before 6.1.4.3-FIPS and 6.1.x-AirGroup before 6.1.3.6-AirGroup as used by Mobility Controller allows remote wireless access points to inject arbitrary web script or HTML via a crafted SSID.


Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters a different vulnerability than CVE-2013-1942 and CVE-2013-2023 as demonstrated by using the alert function in the jQuery parameter. NOTE: these are the same parameters as CVE-2013-1942 but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.


Cross-site scripting (XSS) vulnerability in the Brother MFC-9970CDW printer with firmware G (1.03) and L (1.10) allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter name (QUERY_STRING) to admin/admin_main.html a different vulnerability than CVE-2013-2507 and CVE-2013-2671.


Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x 7.x and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL related to a stored XSS issue.


Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbitrary web script or HTML via a (1) tag name to the Shortlog table in templates/shortlog.php or branch name to the (2) Shortlog table in templates/shortlog.php or (3) Heads table in plates/summary.php.


Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev16 6.22.0 before rev15 6.22.1 before rev17 7.0.1 before rev6 and 7.0.2 before rev7 allow remote attackers to inject arbitrary web script or HTML via (1) a javascript: URL (2) malformed nested SCRIPT elements (3) a mail signature or (4) JavaScript code within an image file.


Cross-site scripting (XSS) vulnerability in the management screen in OpenPNE 3.4.x before 3.4.21.1 3.6.x before 3.6.9.1 and 3.8.x before 3.8.5.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving the \mobile version color scheme.\


Cross-site

scripting

(XSS)

vulnerability

in

the

adminAuthorization

function

in

in

LOCKON

EC-CUBE

through

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

URL

associated

with

the

management

screen.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Cisco

Linksys

router

with

firmware

build

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

parameter

to

apply.cgi

or

or

parameter

to

storage/apply.cgi.


Cross-site scripting (XSS) vulnerability in IBM Sterling Control Center (SCC) 5.2 before 5.2.0.9 5.3 before 5.3.0.4 and 5.4 through 5.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving invalid characters.


Cross-site scripting (XSS) vulnerability in Jenkins before 1.514 LTS before 1.509.1 and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the \edit own webform content\ or \edit all webform content\ permissions to inject arbitrary web script or HTML via a component label.


Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tag parameter to apps/bookmarks/ajax/addBookmark.php or (2) dir parameter to apps/files/ajax/newfile.php which is passed to apps/files/js/files.js.


ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to \formData=save\ requests a different version than CVE-2013-0731.


Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors possibly related to incomplete blacklists a different vulnerability than CVE-2013-1942 and CVE-2013-2022.


Multiple cross-site scripting (XSS) vulnerabilities in the Brother MFC-9970CDW printer with firmware L (1.10) allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) val parameter to admin/admin_main.html; (3) id (4) val or (5) arbitrary parameter name (QUERY_STRING) to admin/profile_settings_net.html; or (6) kind or (7) arbitrary parameter name (QUERY_STRING) to fax/general_setup.html a different vulnerability than CVE-2013-2507 and CVE-2013-2670.


Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to requests/vlm_cmd.xml (2) dir parameter to requests/browse.xml or (3) URI in a request which is returned in an error message through share/lua/intf/http.lua.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Rational Focal Point 6.5.x and 6.6.x before 6.6.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Belkin N900 router allow remote attackers to inject arbitrary web script or HTML via the (1) ssid2 parameter to wl_channel.html or (2) guest_psk parameter to wl_guest.html.


Cross-site

scripting

(XSS)

vulnerability

in

in

LOCKON

EC-CUBE

through

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

vectors

involving

the

field

a

different

vulnerability

than


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Open-Xchange

AppSuite

and

Server

before

before

before

before

before

and

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

embedded

VBScript

object/data

content

a

Content-Type

header

or

encoding

aka

Bug

IDs

and


Multiple cross-site scripting (XSS) vulnerabilities in the RecommendSearch feature in the management screen in LOCKON EC-CUBE before 2.12.5 allow remote attackers to inject arbitrary web script or HTML via vectors involving the rank parameter a different vulnerability than CVE-2013-3652.


Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin before .49 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified HTML header fields to (1) 400.php (2) 403.php or (3) 403.php.


Cross-site scripting (XSS) vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the \Business Manager\ permission to inject arbitrary web script or HTML via the property_name parameter related to editing property details.


Cross-site scripting (XSS) vulnerability in Grandstream GXV3501 GXV3504 GXV3601 GXV3601HD/LL GXV3611HD/LL GXV3615W/P GXV3651FHD GXV3662HD GXV3615WP_HD GXV3500 and possibly other camera models before firmware 1.0.4.44 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.


Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action (3) campaignname (4) campaignformat or (5) emailtemplate parameter to campaign/campaigntwo.php; the (6) listid parameter to list/edit.php; the (7) campaignid or (8) siteurl parameter to campaign/editcampaign.php; the (9) campaignid parameter to campaign/selectlistb4send.php; the (10) campaignid (11) campaignname (12) campaignsubject or (13) selectedcampaigns parameter to campaign/sendCampaign.php; or the (14) campaignid (15) campaignname (16) campaignformat or (17) action parameter to campaign/updatecampaign.php.


Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with firmware before 1.46.45 allows remote attackers to inject arbitrary web script or HTML via the ErrorMsg parameter.


Cross-site scripting (XSS) vulnerability in the web framework in the unified-communications management implementation in Cisco Unified Operations Manager and Unified Service Monitor allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter aka Bug IDs CSCuh47574 and CSCuh95997.


Multiple cross-site scripting (XSS) vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the (1) UserName or (2) Password to the NAS User Setup page (3) deviceName to USB_advanced.htm or (4) Network Key to the Wireless Setup page.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

CMSLogik

and

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

admin/settings;

or

parameter

to

or

parameter

to

slug

parameter

to

or

parameter

to

NOTE:

this

issue

might

be

resultant

from

CSRF.


Cross-site scripting (XSS) vulnerability in the web framework in Cisco Content Security Management on Security Management Appliance (SMA) devices allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter aka Bug ID CSCuh24749.


Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress plugin before 1.1.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) message (2) photo-message or (3) youtube-message parameter.


Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Web\\Content\\Help\\ in the Web Client in IBM Cognos Command Center (aka Star Command Center or Star Analytics) before 10.1 when Internet Explorer is used allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the foundation-webapp/admin/ directory (2) the NeDi component or (3) the Noma component.


Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message.


Multiple cross-site scripting (XSS) vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) package parameter to www/admin/plugin-index.php or the (2) group parameter to www/admin/plugin-settings.php.


Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script or HTML via vectors involving incorrect auto-selection of the Shift JIS encoding leading to cross-domain scrolling events aka \Shift JIS Character Encoding Vulnerability \ a different vulnerability than CVE-2013-0015.


Cross-site scripting (XSS) vulnerability in EMC Documentum Webtop before 6.7 SP2 P07 Documentum WDK before 6.7 SP2 P07 Documentum Taskspace before 6.7 SP2 P07 Documentum Records Manager before 6.7 SP2 P07 Documentum Web Publisher before 6.5 SP7 Documentum Digital Asset Manager before 6.5 SP6 Documentum Administrator before 6.7 SP2 P07 and Documentum Capital Projects before 1.8 P01 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter in a URL.


Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in Cisco Unified Operations Manager allow remote attackers to inject arbitrary web script or HTML and obtain improperly secured cookies via unspecified vectors aka Bug ID CSCud80186.


Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) _loginUserName parameter to application/login/login.html (2) my_account_login parameter to c/portal_public/login or (3) email parameter to forgotPassword.


janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')


calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')


The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-bridge/bridge_cp.php file which allows attackers to inject arbitrary web scripts in versions up to and including 6.1. Due to missing authorization checks on the cc_whmcs_bridge_add_admin function low-level authenticated users such as subscribers can exploit this vulnerability.


The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed


Nextcloud is an open-source self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Talk application is upgraded to patched versions 10.0.7 10.1.4 11.1.2 11.2.0 or 12.0.0. As a workaround use a browser that has support for Content-Security-Policy.


IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215592.


The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the ~/inc/admin/main.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.2.


A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf.


The

Parsian

Bank

Gateway

for

Woocommerce

WordPress

plugin

is

vulnerable

to

Reflected

Cross-Site

Scripting

via

and

parameter

due

to

a

on

variables

found

in

the

file

which

allows

attackers

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including


The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS'PHP_SELF'` in the ucOptions.php file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.


The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the ~/llm.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.0.


A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box . .


The

Simple

Job

Board

WordPress

plugin

is

vulnerable

to

Stored

Cross-Site

Scripting

due

to

insufficient

escaping

on

the

variable

echo'd

out

via

the

file

which

allowed

attackers

with

administrative

user

access

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including

This

affects

multi-site

installations

where

is

disabled

for

administrators

and

sites

where

is

disabled.


The duoFAQ - Responsive Flat Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.4.8.


The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18 from 8.6.0 before 8.13.10 and from version 8.14.0 before 8.18.2 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the handling of supplied content such as from a PDF when pasted into a field such as the description field.


IBM Jazz Foundation (IBM Jazz Team Server 6.0.6 6.0.6.1 7.0 7.0.1 and 7.0.2) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214619.


IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215306.


The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the ~/h5p-css-editor.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.0.


The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/functions.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.2.


The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in the ~/processresponse.php file which allows attackers to inject arbitrary web scripts in versions up to and including 3.0.


The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/real-wysiwyg.php file which allows attackers to inject arbitrary web scripts in versions up to and including 0.0.2.


IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214534.


Nextcloud is an open-source self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Contacts application is upgraded to 4.0.3. As a workaround one may use a browser that has support for Content-Security-Policy.


Multiple Cross Site Scripting (XSS) vulnerabilities exist in VFront 0.99.5 via the (1) s parameter in search_all.php and the (2) msg parameter in add.attach.php.


Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability the `next.config.js` file must have `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default or the instance is deployed on Vercel the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1.


baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.


Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS) attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed Discourse's default Content Security Policy have allowed for moderators to modify categories. This issue is patched in the latest stable beta and tests-passed versions of Discourse. Users are advised to ensure that the Content Security Policy is enabled and has not been modified in a way which would make it more vulnerable to XSS attacks.


The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER'PHP_SELF'` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.


Multiple Cross Site Scripting (XSS) vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in (1) public/search.php and in the (2) c parameter in admin.php.


The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image-gallery.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.0.6.


The

Easy

Digital

Downloads

WordPress

plugin

is

vulnerable

to

Reflected

Cross-Site

Scripting

via

the

and

parameters

found

in

the

file

which

allows

attackers

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including


The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field.


Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.


IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213862.


The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts in versions 7.5.0.727 - 7.5.2.727.


A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to execute arbitrary javascript code.


Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked but other types that allow JavaScript execution (such as text/xml) are not blocked.


The

LearnPress

WordPress

plugin

is

vulnerable

to

Stored

Cross-Site

Scripting

due

to

insufficient

escaping

on

the

parameter

found

in

the

file

which

allowed

attackers

with

administrative

user

access

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including

This

affects

multi-site

installations

where

is

disabled

for

administrators

and

sites

where

is

disabled.

Please

note

that

this

is

seperate

from


Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0 malicious actors can use the web client built-in dialog to display a malicious string leading to cross-site scripting (XSS). XSS could compromise the API request token. This issue has been fixed in version 12.51.0. There are no known workarounds aside from upgrading.


A cross-site scripting (XSS) vulnerability has been reported to affect QTS QuTS hero and QuTScloud. If exploited this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later


The Notices WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/notices.php file which allows attackers to inject arbitrary web scripts in versions up to and including 6.1.


The More From Google WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/morefromgoogle.php file which allows attackers to inject arbitrary web scripts in versions up to and including 0.0.2.


The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/yabp.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.4.


IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0 19.0 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512.


Cross-site

scripting

(XSS)

vulnerability

in

the

Asset

module

in

Liferay

Portal

through

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

when

creating

a

collection

page

via

the

_com_liferay_asset_list_web_portlet_AssetListPortlet_title

parameter.


The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST'page' parameter which is echoed out on inc/nxs_class_snap.php by supplying the appropriate value 'nxssnap-post' to load the page in $_GET'page' along with malicious JavaScript in $_POST'page'.


The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp-admin.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.2.


A reflected cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Ragic Cloud DB. If exploited this vulnerability allows remote attackers to inject malicious code. QNAP have already disabled and removed Ragic Cloud DB from the QNAP App Center pending a security patch from Ragic.


openBaraza HCM 3.1.6 does not properly neutralize user-controllable input which allows reflected cross-site scripting (XSS) on multiple pages: hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view= and data=).


The

Border

Loading

Bar

WordPress

plugin

is

vulnerable

to

Reflected

Cross-Site

Scripting

via

the

`f`

and

`t`

parameter

found

in

the

file

which

allows

attackers

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including


SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g. subject description) of the document form.


The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/simplesamlphp-authentication.php file which allows attackers to inject arbitrary web scripts in versions up to and including 0.7.0.


IBM Business Automation Workflow 18.0 19.0 20 0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209165.


Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0 and Liferay DXP 7.1 before fix pack 23 7.2 before fix pack 13 and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command.


IBM i 7.2 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208404.


The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts in versions up to and including 4.25.


The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/simple-matted-thumbnail.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.01.


The Custom Menu Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selected_menu parameter found in the ~/custom-menus.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.3.3.


The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows attackers to inject arbitrary web scripts in versions up to and including 2.2.


IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208405.


The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the ~/user-activation-email.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.3.0.


The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/dj-email-publish.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.7.2.


A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Image2PDF: Image2PDF 2.1.5 ( 2021/08/17 ) and later


The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/index.php file which allows attackers to inject arbitrary web scripts in versions up to and including 2.0.


The 3D Cover Carousel WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/cover-carousel.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.0.


The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the ~/wap/writer.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.13.2.


Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API devices which may allow an attacker to remotely execute code.


SAP NetWeaver - versions 700 701 702 730 does not sufficiently encode user-controlled inputs allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application which is then reflected to the victim and executed by the web browser resulting in Cross-Site Scripting vulnerability.


Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an incomplete fix in CVE-2021-35463.


The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts in versions up to and including 0.1.


Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter comment of the API events which may allow an attacker to remotely execute code.


IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049.


IBM QRadar Advisor 2.5 through 2.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209566.


The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.0.


Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter supplier of the API maintenance which may allow an attacker to remotely execute code.


A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.20 and later


The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/includes/plugin_settings.php file which allows attackers to inject arbitrary web scripts in versions up to and including 2.0.10.


The RentPress WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selections parameter found in the ~/src/rentPress/AjaxRequests.php file which allows attackers to inject arbitrary web scripts in versions up to and including 6.6.4.


IBM Cognos Analytics 11.1.7 11.2.0 and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211240.


The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.4.1.


IBM Tivoli Key Lifecycle Manager 3.0 3.0.1 4.0 and 4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212791.


openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-site scripting (XSS) attack against an administrative user from hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view=).


Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session token theft.


The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category_name parameter in the ~/admin-panel.php file which allows attackers to inject arbitrary web scripts in versions up to and including 0.4.1.


The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/adminUI/settings.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.2.1.0.


IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209706.


Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader which may allow an attacker to remotely execute code.


A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QcalAgent. If exploited this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and later


The

OSD

Subscribe

WordPress

plugin

is

vulnerable

to

Reflected

Cross-Site

Scripting

via

the

parameter

found

in

the

file

which

allows

attackers

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including


The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/wp-scrippets.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.5.1.


The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description parameter found in the ~/templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts in versions up to and including 2.1.1.


Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule which may allow an attacker to remotely execute code.


The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-library.php file which allows attackers to inject arbitrary web scripts in versions up to and including 2.0.3.


IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211408.


The

RSVPMaker

Excel

WordPress

plugin

is

vulnerable

to

Reflected

Cross-Site

Scripting

due

to

a

reflected

value

in

the

file

which

allows

attackers

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including


The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the ~/htaccess-redirect.php file which allows attackers to inject arbitrary web scripts in versions up to and including 0.3.1.


InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not perform sufficient input validation on client requests from the help page. This may allow an attacker to perform a reflected cross-site scripting attack which could allow an attacker to run code on behalf of the client browser.


The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php file which allows attackers to inject arbitrary web scripts in versions up to and including 0.0.1.


The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/settings.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.0.1.


Cross-site

scripting

(XSS)

vulnerability

in

the

Blogs

module's

edit

blog

entry

page

in

Liferay

Portal

through

and

Liferay

DXP

before

fix

pack

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

_com_liferay_blogs_web_portlet_BlogsAdminPortlet_title

and

_com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle

parameter.


The

Advance

Search

WordPress

plugin

is

vulnerable

to

Reflected

Cross-Site

Scripting

via

the

parameter

found

in

the

file

which

allows

attackers

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including


IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212357.


The

GNU-Mailman

Integration

WordPress

plugin

is

vulnerable

to

Reflected

Cross-Site

Scripting

via

the

parameter

found

in

the

file

which

allows

attackers

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including


Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier and Liferay DXP 7.0 before fix pack 101 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web script or HTML via the output of a script.


IBM Security Verify 10.0.0 10.0.1.0 and 10.0.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209563.


The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER\PHP_SELF\ value in the ~/edit-comments-xt.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.0.


IBM Aspera Cloud is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208343.


The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.2.


The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmc_TF_user and pmc_TF_password parameter found in the ~/twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts in versions up to and including 3.1.


The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file which allows attackers to inject arbitrary web scripts in versions up to and including 0.7.4.1.


The Konnichiwa! Membership WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the plan_id parameter in the ~/views/subscriptions.html.php file which allows attackers to inject arbitrary web scripts in versions up to and including 0.8.3.


The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the ~/post-title-counter.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.1.


Dynamics Finance and Operations Cross-site Scripting Vulnerability


Magento versions 2.4.2 (and earlier) 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.


Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter.


Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened by victim the payload is triggered.


Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter.


An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A Stored Cross-Site Scripting (XSS) issue in \Configuration > Hosts\ allows remote authenticated users to inject arbitrary web script or HTML via the Alias parameter.


TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).


index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability


Multiple

cross-site

scripting

(XSS)

vulnerabilities

exist

in

SITA

Software

Azur

CMS

and

earlier

which

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

ADRESSE

LOCALITE

parameters

to

and

the

parameter

to


** UNSUPPORTED WHEN ASSIGNED ** CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the platform users. The affected endpoints are: cgi/nhWeb with the parameter report aviewbin/filtermibobjects.pl with the parameter namefilter and aviewbin/query.pl with the parameters System SystemText Group and GroupText. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204824.


A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that when viewed by an administrator can execute arbitrary JavaScript in the context of the NXRM application.


IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204164.


IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207616.


HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a note. An attacker with write access to a note can embed HTML tags in the Open Graph metadata section of the note resulting in the frontend rendering the script tag as part of the `<head>` section. Unless your instance prevents guests from editing notes this vulnerability allows unauthenticated attackers to inject JavaScript into notes that allow guest edits. If your instance prevents guests from editing notes this vulnerability allows authenticated attackers to inject JavaScript into any note pages they have write-access to. This vulnerability is patched in version 1.8.2. As a workaround one can disable guest edits until the next update.


IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203029.


IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204265.


IBM Sterling B2B Integrator Standard Edition 5.2.0.0. through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204912.


IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 201694.


IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request a remote attacker could exploit this vulnerability to inject HTTP HOST header which will allow the attacker to conduct various attacks against the vulnerable system including cross-site scripting cache poisoning or session hijacking. IBM X-Force ID: 205680.


IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199482.


IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204349.


IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204331.


A UXSS was discovered in the Thanos-Soft Cheetah Browser in Android 1.2.0 due to the inadequate filter of the intent scheme. This resulted in Cross-site scripting on the cheetah browser in any website.


IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204343.


CourseMS (aka Course Registration Management System) 2.1 is affected by cross-site scripting (XSS). When an attacker with access to an Admin account creates a Job Title in the Site area (aka the admin/add_jobs.php name parameter) they can insert an XSS payload. This payload will execute whenever anyone visits the registration page.


A local cross-site scripting (XSS) vulnerability was discovered in Aruba CX 6200F Switch Series Aruba 6300 Switch Series Aruba 6400 Switch Series Aruba 8320 Switch Series Aruba 8325 Switch Series Aruba 8400 Switch Series Aruba CX 8360 Switch Series version(s): Aruba AOS-CX firmware: 10.04.xxxx - versions prior to 10.04.3070 10.05.xxxx - versions prior to 10.05.0070 10.06.xxxx - versions prior to 10.06.0110 10.07.xxxx - versions prior to 10.07.0001. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.


IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204330.


IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199400.


IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205045.


IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 202268.


IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204825.


IBM Business Automation Workflow 18.0 19.0 20.0 and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 206581.