IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168519.


IBM Financial Transaction Manager 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172882.


IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162807.


IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157383.


IBM DOORS Next Generation (DNG/RRC) 6.0.2. 6.0.6 and 6.0.61 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172808.


IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157110.


IBM Business Automation Workflow 18.0.0.0 18.0.0.1 18.0.0.2 and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159125.


IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163776.


Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier RS-500KI firmware version Ver.01.00.0070 and earlier PR-500MI/RT-500MI firmware version Ver.01.01.0014 and earlier and RS-500MI firmware version Ver.03.01.0019 and earlier and Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier and PR-500MI/RT-500MI firmware version Ver.01.01.0011 and earlier) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


DOM-based cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Analysis Object Page.


A remote multiple cross-site scripting vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.


DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.


An Improper Neutralization of Input During Web Page Generation (\Cross-site Scripting\) in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.


Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Professional Edition v3.1.1 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.


Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a persistent XSS vulnerability. This issue affects: Siemens AG Polarion All versions < 19.2.


A cross-site scripting (XSS) vulnerability in static/js/trape.js in Trape through 2019-05-08 allows remote attackers to inject arbitrary web script or HTML via the country query or refer parameter to the /register URI because the jQuery prepend() method is used.


A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default so any string input will be invalid.


In firmware version 4.50 of Zyxel XGS2210-52HP multiple stored cross-site scripting (XSS) issues allows remote authenticated users to inject arbitrary web script via an rpSys.html Name or Location field.


The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted this can lead to a variety of potential vulnerabilities like SQL injection or cross-site scripting (XSS).


A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration web server of the affected device could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed. At the stage of publishing this security advisory no public exploitation is known.


Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a reflected XSS vulnerability. This issue affects: Siemens AG Polarion All versions < 19.2.


A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions) EN100 Ethernet module IEC 61850 variant (All versions < V4.37) EN100 Ethernet module IEC104 variant (All versions) EN100 Ethernet module Modbus TCP variant (All versions) EN100 Ethernet module PROFINET IO variant (All versions). The web interface could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify content of particular web pages causing the application to behave in unexpected ways for legitimate users. Successful exploitation does not require for an attacker to be authenticated to the web interface. This could allow the attacker to read or modify contents of the web application. At the time of advisory publication no public exploitation of this security. vulnerability was known.


Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser.


Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web-based management interface. The vulnerabilities are due to insufficient validation of user-supplied input that is processed by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and subsequently access a specific web interface page. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A vulnerability in the Clientless SSL VPN (WebVPN) portal of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.


MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag it was possible to hijack the session cookie by exploiting this vulnerability.


Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content adding users uploading backdoors to the server etc. Successful exploitation occurs when an admin user visits a notification page with stored cross-site scripting.


A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. To exploit this vulnerability the attacker needs valid administrator credentials.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because the web-based management interface of the affected device does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame.


Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.


A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco SPA122 ATA with Router Devices could allow an unauthenticated adjacent attacker to conduct cross-site scripting attacks. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by sending malicious input to the affected software through crafted DHCP requests and then persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


Symantec My VIP portal previous version which has already been auto updated was susceptible to a cross-site scripting (XSS) exploit which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users or potentially bypass access controls such as the same-origin policy.


A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall USG and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter.


A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated remote attacker to conduct cross-site scripting attacks. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input in multiple sections of the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field.


A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms versions 5.9 and 5.10 due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.


A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11) Spectrum Power 4 (Corporate User Interface) (Version v4.75) Spectrum Power 5 (Corporate User Interface) (All versions < v5.50) Spectrum Power 7 (Corporate User Interface) (All versions <= v2.20). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user does not need to be logged into the web interface in order for the exploitation to succeed.At the stage of publishing this security advisory no public exploitation is known.


Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.


Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality


Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame resulting in a cross-site scripting vulnerability exploitable by users able to change those.


Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter.


Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering a different vulnerability than CVE-2018-20583.


Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views resulting in a cross-site scripting vulnerability in Jenkins 2.145 2.138.1 or older exploitable by users able to change various job/build properties.


Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name) /wlsecrefresh.wl (wlWscCfgMethod wl_wsc_reg).


A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI.


All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An attacker website is able to load the Stroom UI into a hidden iframe. Using that iframe the attacker site can issue commands to the Stroom UI via an XSS vulnerability to take full control of the Stroom UI on behalf of the logged-in user.


In Apache HTTP Server 2.4.0-2.4.39 a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.


Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message resulting in a cross-site scripting vulnerability exploitable by users able to define log parsing rules.


Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser.


All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). This affects the development mode error handler when an exception message contains untrusted data. Note the production mode error handler is not vulnerable - so for this to be utilized in production it would require users to not disable development mode.


The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature and has now been removed. *Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected.*. This vulnerability affects Firefox < 67.


The MDM server component of TIBCO Software Inc's TIBCO MDM contains multiple vulnerabilities that theoretically allow an authenticated user with specific roles to perform cross-site scripting (XSS) attacks. This issue affects TIBCO Software Inc.'s TIBCO MDM version 9.0.1 and prior versions; version 9.1.0.


Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed evading cross-site scripting (XSS) filtering. This vulnerability affects Firefox < 68.


Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication which is mishandled during an _viewlog operation.


Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module (2) #307638 - Campaign Creator module (3) #316994 - Attributes field (4) I#316995 - Icon Selection module (5) #317000 - Latitude field (6) #317000 - Longitude field (7) #317017 - UploadPackage2.aspx module (8) #317072 - Context menu or (9) I#317073 - Insert from Template dialog.


The web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains vulnerabilities that theoretically allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: 7.14.0; 7.14.1; 10.0.0; 10.0.1; 10.1.0; 10.2.0 and TIBCO Spotfire Server: 7.14.0; 10.0.0; 10.0.1; 10.1.0; 10.2.0.


A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process. Because addons.mozilla.org and accounts.firefox.com have close ties to the Firefox product malicious manipulation of these sites within the browser can potentially be used to modify a user's Firefox configuration. These two sites will now be isolated into their own process and not allowed to be loaded in a standard content process. This vulnerability affects Firefox < 69.


Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php the go parameter to /admin/index.php?register=register or the error parameter to admin/index.php?action=favicon.


Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.


A vulnerability in the web-based management interface of Cisco Stealthwatch Enterprise could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue whenever My View Page is displayed.


Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script or HTML code in the context of the interface which could allow the attacker to gain access to sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The attacker must have valid administrator credentials. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by injecting malicious code into a troubleshooting file. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory listing.


A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious code in certain sections of the interface that are visible to other users. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. An attacker would need valid administrator credentials to exploit this vulnerability.


A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager (Unified CDM) could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


The fileview package v0.1.6 has inadequate output encoding and escaping which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.


The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page.


The \/cgi-bin/go\ page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments organizations companies and universities.


A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. To exploit this vulnerability the attacker needs administrator credentials. This vulnerability affects Cisco DNA Center Software releases earlier than 1.3.0.6 and 1.3.1.4.


The login feature in \/cgi-bin/portal\ in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments organizations companies and universities.


JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS) potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.


A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected application. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected application. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.


An

cross-site

scripting

vulnerability

exists

in

Jenkins

Config

File

Provider

Plugin

and

earlier

in

that

allows

attackers

with

permission

to

define

shared

configuration

files

to

execute

arbitrary

JavaScript

when

a

user

attempts

to

delete

the

shared

configuration

file.


A

cross-site

scripting

vulnerability

exists

in

Jenkins

Warnings

Next

Generation

Plugin

and

earlier

in

that

allows

attackers

with

the

ability

to

control

warnings

parser

input

to

have

Jenkins

render

arbitrary

HTML.


The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.


An

cross-site

scripting

vulnerability

exists

in

Jenkins

Blue

Ocean

Plugins

and

earlier

in

that

allows

attackers

with

permission

to

edit

a

user's

description

in

Jenkins

to

have

Blue

Ocean

render

arbitrary

HTML

when

using

it

as

that

user.


AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript code in the context of the user's browser if the victim opens or searches for a node whose \Display Name\ contains an XSS payload.


An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser related to resiliency plans functionality. A victim must open a resiliency plan that an attacker has access to.


: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.


: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the LDAP cbURL parameter of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.


DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.


: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ModalWindowPopup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.


: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uploaditem.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.


An issue was discovered on AudioCodes Mediant 500L-MSBR 500-MBSR M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting (XSS) vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.


: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prefs.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.


PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Reflected Cross-site Scripting (XSS) via the err value in a .ico picture upload.


Symantec VIP Enterprise Gateway (all versions) may be susceptible to a cross-site scripting (XSS) exploit which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.


WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.


A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through the SNMP protocol.


The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js it is affected by this vulnerability.


A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through web application form inputs.


Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend the attack is only effective against browsers lacking support for Content-Security-Policy such as Internet Explorer 11. On a Zulip server using the S3 uploads backend the attack is confined to the origin of the configured S3 uploads hostname and cannot reach the Zulip server itself.


A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the vManage software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


A vulnerability in the web-based GUI of Cisco IP Phone 6800 7800 and 8800 Series with Multiplatform Firmware could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based GUI of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A vulnerability in the web framework of Cisco Emergency Responder could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of some parameters that are passed to the web server of the affected software. An attacker could exploit this vulnerability by persuading a user to access a malicious link or by intercepting a user request for the affected web interface and injecting malicious code into that request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web-based management interface or access sensitive browser-based information.


The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js it is affected by this vulnerability.


GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.


Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0. Potential impacts of this vulnerability include cross-user defacement cache poisoning Cross-site scripting (XSS) and page hijacking.


A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare through 7.0.0.C1.609 allows remote attackers to inject arbitrary web script or HTML via the handle parameter (webExMeetingLogin.jsp) and meetingKey parameter (deleteWebExMeetingCheck.jsp).


Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.


A vulnerability in the web-based management interface of Cisco Crosswork Change Automation could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information on the affected system.


The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.1.fixS and below versions 5.9.3 5.9.4 5.9.5 5.9.6 and 5.9.7.


A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/groups.jsp. The groupName parameter is vulnerable: the reflected cross-site scripting occurs immediately after the group is created. The malicious script is stored and will be executed again whenever /WiKIDAdmin/groups.jsp is visited.


The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker to perform a reflected cross-site scripting (XSS) attack. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below versions 7.12.0 7.13.0 7.14.0 10.0.0 10.0.1 10.1.0 10.2.0 10.2.1 10.3.0 10.3.1 10.3.2 10.3.3 and 10.3.4 versions 10.4.0 10.5.0 and 10.6.0.


The Digital Asset Manager Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13 versions 4.1.0 4.2.0 4.2.1 and 4.2.2.


A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting). This is a separate bypass from CVE-2019-17000.*Note: This flaw only affected Firefox 69 and was not present in earlier versions.*. This vulnerability affects Firefox < 70.


A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/adm_usrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after the user is created. The malicious script is stored and will be executed whenever /WiKIDAdmin/adm_usrs.jsp is visited.


The Web server component of TIBCO Software Inc.'s TIBCO EBX contains multiple vulnerabilities that theoretically allow authenticated users to perform stored cross-site scripting (XSS) attacks and unauthenticated users to perform reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions up to and including 5.8.1.fixR versions 5.9.3 5.9.4 5.9.5 and 5.9.6.


WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

WiKID

Enterprise

Server

through

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

that

is

triggered

when

Logs.jsp

is

visited.

The

column

is

retrieved

and

displayed

unsanitized

on

Logs.jsp.

A

remote

attack

can

populate

the

column

with

malicious

values

via:

H

parameter

to

S

parameter

to:

a

parameter

to:


An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. A reflected Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script via the /osm/report/ password parameter.


The user interface component of TIBCO Software Inc.'s TIBCO Patterns - Search contains multiple vulnerabilities that theoretically allow authenticated users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Patterns - Search: versions 5.4.0 and below.


A

cross-site

scripting

(XSS)

vulnerability

in

in

LimeSurvey

and

earlier

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

tolang

parameter

as

demonstrated

by

the

index.php/admin/translate/sa/index/surveyid/336819/lang/


By default Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers who remove dot segments before sending the request. However Mobile applications may be vulnerable.


The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13 version 4.1.0.


A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scripting occurs immediately after a .csv file is uploaded. The malicious script is stored and can be executed again when the List Pre-Registration functionality is used.


OPT/NET

BV

NG-NetMS

version

and

earlier

versions

contains

a

Cross

Site

Scripting

(XSS)

vulnerability

in

page.

The

\id\

and

\operation\

GET

parameters

can

be

used

to

inject

arbitrary

JavaScript

which

is

returned

in

the

page's

response

that

can

result

in

Cross-site

scripting.This

attack

appear

to

be

exploitable

via

network

connectivity.


A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can execute arbitrary JavaScript code by providing arbitrary API endpoint that will not be chcecked by sale pickup event.


A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via title of an order when configuring sales payment methods for a store.


A stored cross-site scripting (XSS) vulnerability exists in Magento 2.1 prior to 2.1.19 Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3. An authenticated user can inject arbitrary Javascript code by manipulating section of a POST request related to customer's email address.


A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3 Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective() function and inject malicious javascript in the cache of the admin dashboard.


In Zoho ManageEngine ADSelfService Plus 5.x through 5704 an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token.


A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Successful exploitation of this vulnerability would result in an attacker being able to bypass the `escapeURL()` function and execute a malicious XSS payload.


A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate downloadable link and cause an invocation of error handling that acceses user input without sanitization.


Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) destination parameter to delete feature; the (2) destination parameter to edit feature; (3) content parameter in the profile feature.


qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=XSS parameter.


qdPM 9.1 suffers from Cross-site Scripting (XSS) in the searchkeywords parameter.


The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS and TIBCO Spotfire Data Science contains a persistent cross-site scripting vulnerability that theoretically allows an authenticated user to gain access to all the capabilities of the web interface available to more privileged users. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0 and TIBCO Spotfire Data Science: versions up to and including 6.4.0.


A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft malicious payload in the template Name field for Email template in the \Design Configuration\ dashboard.


Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attackers to inject arbitrary web script or HTML via the body of an email. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects different sets of versions.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Gnew

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

users/profile.php

articles/index.php

or

admin/polls.php;

parameter

to

news/submit.php;

parameter

to

news/send.php

or

comments/add.php;

or

or

parameter

to

posts/edit.php.


Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17 as used in Moodle through 2.3.11 2.4.x before 2.4.9 2.5.x before 2.5.5 and 2.6.x before 2.6.2 allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain a related issue to CVE-2013-7342.


Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1.2 and 3.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) post-menu field to edit.php or (2) Display name field to settings.php. NOTE: The Custom Permalink Structure and Email Address fields are already covered by CVE-2012-6621.


LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php which allows remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent cross-site scripting (XSS) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7033.


Multiple cross-site scripting (XSS) vulnerabilities in Zope as used in Plone 3.3.x through 3.3.6 4.0.x through 4.0.9 4.1.x through 4.1.6 4.2.x through 4.2.7 and 4.3 through 4.3.2 allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary web script or HTML via the URL to the (1) showRSS (2) showATOM or (3) showDailyRSS function; a (4) file name to the importFile function; or (5) vectors related to bookmarks.


Multiple cross-site scripting (XSS) vulnerabilities in ematStaticAlertTypes.jsp in the Alert Settings section in Dell SonicWALL Global Management System (GMS) Analyzer and UMA EM5000 7.1 SP1 before Hotfix 134235 allow remote authenticated users to inject arbitrary web script or HTML via the (1) valfield_1 or (2) value_1 parameter to createNewThreshold.jsp.


Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php (2) RESULT parameter to info.php or (3) receiver parameter to bsc_sms_send.php.


Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the roomid parameter.


The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

and

in

SPIP

before

and

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

author

name

field.


Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow (formerly FLOW3) 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input which is returned in an error message.


The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing.


Multiple cross-site scripting (XSS) vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP Referer header to saa.php (2) username parameter to login.php or (3) keyword_list parameter to keysearch.php.


Cross-site

scripting

(XSS)

vulnerability

in

vTiger

CRM

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

or

unspecified

vectors

to

deletetask.php

edittask.php

savetask.php

or

saveworkflow.php.


Cross-site

scripting

(XSS)

vulnerability

in

the

JsonBuilder

implementation

in

ProjectForge

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

an

autocompletion

string

related

to

and


Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 allows remote attackers to inject arbitrary web script or HTML via the publication name which is not properly handled in an error message. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects different sets of versions.


Multiple cross-site scripting (XSS) vulnerabilities in the web based operator client in LiveZilla before 5.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name of an uploaded file or (2) customer name in a resource created from an uploaded file a different vulnerability than CVE-2013-7003.


Cross-site scripting (XSS) vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the \Administer EU Cookie Compliance popup\ permission to inject arbitrary web script or HTML via unspecified configuration values.


Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.3 allows remote attackers to inject arbitrary web script or HTML by using URL encoding within the callback parameter name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7342.


LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php which might allow remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent cross-site scripting (XSS) attack.


Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31 4.7.0 through 4.7.16 6.0.0 through 6.0.11 and 6.1.0 through 6.1.6 when the Rewritten Property Mapper is enabled allows remote attackers to inject arbitrary web script or HTML via unspecified input which is returned in an error message. NOTE: this might be the same vulnerability as CVE-2013-7072.


Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32 4.7.x before 4.7.17 6.0.x before 6.0.12 6.1.x before 6.1.7 and the development versions of 6.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.


The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings.


Multiple cross-site scripting (XSS) vulnerabilities in register.php in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name (2) last_name (3) email or (4) username parameter.


Cross-site scripting (XSS) vulnerability in the Calendar module in Olat 7.8.0.1 (b20130821 N1) allows remote attackers to inject arbitrary web script or HTML via the Location field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the HTTP Option in IBM Sterling Connect:Enterprise 1.3 before 1.3.0.2 iFix 1 and 1.4 before 1.4.0.0 iFix 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a \cross-frame scripting\ issue.


Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1 10.1 before IF6 10.1.1 before IF5 10.2 before IF7 10.2.1 before IF4 and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.


Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attacks via the HTTP Referer header.


Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 and WebSphere Virtual Enterprise 7.x before 7.0.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site

scripting

(XSS)

vulnerability

in

the

helper

in

in

Ruby

on

Rails

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

unit

parameter.


Multiple cross-site scripting (XSS) vulnerabilities in NagiosQL 3.2 SP2 allow remote attackers to inject arbitrary web script or HTML via the txtSearch parameter to (1) admin/hostdependencies.php (2) admin/hosts.php or other unspecified pages that allow search input related to the search functionality in functions/content_class.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Atmail

Webmail

Server

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

filter

parameter

to

or

mailId

parameter

to

index.php/mail/mail/movetofolder/fromFolder/INBOX/toFolder/INBOX.Trash.

NOTE:

the

view

attachment

message

process

vector

is

already

covered

by


The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.


Multiple cross-site scripting (XSS) vulnerabilities in JAMon (Java Application Monitor) 2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listenertype or (2) currentlistener parameter to mondetail.jsp or ArraySQL parameter to (3) mondetail.jsp (4) jamonadmin.jsp (5) sql.jsp or (6) exceptions.jsp.


Cross-site scripting (XSS) vulnerability in the Secure Access Service Web rewriting feature in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r17 7.3 before 7.3r8 7.4 before 7.4r6 and 8.0 before 8.0r1 when web rewrite is enabled allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Algo One as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0 ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0 and ACSWeb in AlgoWebApps 5.0.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2013-6299 CVE-2013-6300 CVE-2013-6301 and CVE-2013-6320.


Multiple cross-site scripting (XSS) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47 4.2 before Patch 26 and 4.5 before Patch 05 as used in Documentum Edition Enterprise Edition Publish Engine and Enterprise Edition Compuset Engine allow remote attackers to inject arbitrary web script or HTML via unspecified input to a (1) xAdmin or (2) xDashboard form.


Cross-site scripting (XSS) vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form.


Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing \crafted hyperlinks with script URL handlers.\


Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.11.9 allow remote attackers to inject arbitrary web script or HTML via the (1) box parameter to messaging/messagebox.php cidToEdit parameter to (2) adminregisteruser.php or (3) admin_user_course_settings.php in admin/ (4) module_id parameter to admin/module/module.php or (5) offset parameter to admin/right/profile_list.php.


Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and the publication name were SPLIT from this CVE ID because they affect different sets of versions.


Multiple cross-site scripting (XSS) vulnerabilities in LiveZilla before 5.1.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) a name in the call administrator feature (2) unspecified vectors to the admins visitor information panel or (3) a text message in a chat session which is saved in the archive section.


Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server 7.x before 7.0.0.31 8.0.x before 8.0.0.8 and 8.5.x before 8.5.5.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in clickstream.js in Y! Toolbar plugin for FireFox 3.1.0.20130813024103 for Mac and 2.5.9.2013418100420 for Windows allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is stored by the victim.


Cross-site scripting (XSS) vulnerability in the Web Content Manager (WCM) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27 6.1.5.x through 6.1.5.3 CF27 7.0.0.x through 7.0.0.2 CF26 and 8.0.0.x before 8.0.0.1 CF09 allows remote attackers to inject arbitrary web script or HTML via vectors involving IFRAME elements.


Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8 Thunderbird ESR 17.x through 17.0.10 and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element a related issue to CVE-2014-2018.


The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6 1.5.x before 1.5.2 and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function as demonstrated by \the login view in django.contrib.auth.views\ and the javascript: scheme.


Cross-site scripting (XSS) vulnerability in IBM Algo One as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0 ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0 and ACSWeb in AlgoWebApps 5.0.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2013-6299 CVE-2013-6300 CVE-2013-6320 and CVE-2013-6333.


Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.x 1.0.22.7 1.1.x 1.24.1 1.3.25.1 through 1.3.25.4 1.4.26.1 through 1.4.26.4 1.5.27.1 through 1.5.27.3 and 1.6.29.1 through 1.6.29.6 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname parameter to admin/access_control_user_edit.php or (2) workname parameter to admin/network_workgroup_domain.php.


Multiple cross-site scripting (XSS) vulnerabilities in ProjeQtOr (formerly Project'Or RIA) before 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) type parameter to view/parameter.php (2) p1value parameter to view/main.php or (3) objectClass parameter to view/objectDetail.php.


Cross-site scripting (XSS) vulnerability in IBM Algo One as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0 ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0 and ACSWeb in AlgoWebApps 5.0.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2013-6299 CVE-2013-6300 CVE-2013-6301 and CVE-2013-6333.


Multiple cross-site scripting (XSS) vulnerabilities on Lexmark W840 through LS.HA.P252 T64x before LS.ST.P344 C935dn through LC.JO.P091 C920 through LS.TA.P152 C53x through LS.SW.P069 C52x through LS.FA.P150 E450 through LM.SZ.P124 E350 through LE.PH.P129 and E250 through LE.PM.P126 printers allow remote authenticated users to inject arbitrary web script or HTML by using (1) SNMP or (2) the Embedded Web Server (EWS) to set the (a) Contact or (b) Location field.


Multiple cross-site scripting (XSS) vulnerabilities in the web interface in the Assurance component in Cisco Prime Collaboration allow remote attackers to inject arbitrary web script or HTML via unspecified vectors aka Bug IDs CSCui92643 CSCui94038 and CSCui94161.


Cross-site scripting (XSS) vulnerability in IBM InfoSphere Enterprise Records 4.5.1 before 4.5.1.7-IER-IF001 and Enterprise Records 5.1.1 before 5.1.1.1-IER-IF003 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Algo One as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0 ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0 and ACSWeb in AlgoWebApps 5.0.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2013-6300 CVE-2013-6301 CVE-2013-6320 and CVE-2013-6333.


Cross-site scripting (XSS) vulnerability in the user interface in the AAA TM vServer in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4 10.0 before 10.0-77.5 and 10.1 before 10.1-118.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in CRU Ditto Forensic FieldStation with firmware 2013Oct15a and earlier allow (1) remote attackers to inject arbitrary web script or HTML via the username parameter in a login or (2) remote authenticated users to inject arbitrary web script or HTML via unspecified form fields.


Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51 as used on the ZyXEL P660HW-D1 Huawei MT882 Sitecom WL-174 TP-LINK TD-8816 and D-Link DSL-2640R and DSL-2641R when the \forbidden author header\ protection mechanism is bypassed allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a \URL redirection\ issue that some sources list separately.


Cross-site scripting (XSS) vulnerability in FileNet P8 Platform Documentation Installable Info Center 4.5.1 through 5.2.0 in IBM FileNet Business Process Manager 4.5.1 through 5.1.0 FileNet Content Manager 4.5.1 through 5.2.0 and Case Foundation 5.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Algo One as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0 ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0 and ACSWeb in AlgoWebApps 5.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Algo One as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0 ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0 and ACSWeb in AlgoWebApps 5.0.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2013-6299 CVE-2013-6301 CVE-2013-6320 and CVE-2013-6333.


Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.


Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2 as used in Moodle through 2.1.10 2.2.x before 2.2.11 2.3.x before 2.3.8 2.4.x before 2.4.5 2.5.x before 2.5.1 and other products allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.


Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name (2) image (3) url or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).


Cross-site scripting (XSS) vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9 1.20.x before 1.20.8 and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the \to\ parameter to index.php.


Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress when the \Friend Connections\ component is enabled allows remote attackers to inject arbitrary web script or HTML via the friendship_request_message parameter to wp-admin/admin-ajax.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1 when ultra-light mode is enabled allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors aka SPR PTHN9ARMFA.


Cross-site

scripting

(XSS)

vulnerability

in

the

function

in

in

the

Password

Policy

module

before

and

before

for

Drupal

allows

remote

authenticated

users

with

the

\Administer

policies\

permission

to

inject

arbitrary

web

script

or

HTML

via

the

\Password

Expiration

Warning\

field

to

the

page.


Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.


Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for MediaWiki 1.19.x before 1.19.8 1.20.x before 1.20.7 and 1.21.x before 1.21.2 allows remote attackers to inject arbitrary web script or HTML via a thread subject.


Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress when \Allow New Registrations to set their own Password\ is enabled allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action. NOTE: some of these details are obtained from third party information.


Cross-site

scripting

(XSS)

vulnerability

in

in

the

internationalization

component

in

Ruby

on

Rails

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

string

that

triggers

generation

of

a

fallback

string

by

the

gem.


An unspecified cross-site scripting (XSS) vulnerability exists in Cryptocat Message Handling 1.1.165.


Cross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Universal Server) before 3.3.0 MP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted encrypted e-mail attachment.


Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information.


Cross-site scripting (XSS) vulnerability in the Hatch theme 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with the \Administer content \ \Create new article \ or \Edit any article type content\ permission to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1 as used in Moodle through 2.1.10 2.2.x before 2.2.11 2.3.x before 2.3.8 2.4.x before 2.4.5 2.5.x before 2.5.1 and other products allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.


Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console and (2) conduct cross-site scripting (XSS) attacks via unspecified vectors related to \live management.\


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

IBM

TRIRIGA

Application

Platform

and

before

and

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

unspecified

input

to

WebProcess.srv

unspecified

input

to

or

unspecified

input

in

a

portalSectionId

action

to


Cross-site scripting (XSS) vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1 6.2 before IF1 and 7.0 before FP1 IF6 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving addition of script to a page.


Cross-site

scripting

(XSS)

vulnerability

in

in

Moodle

through

before

before

and

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

an

answer

to

a

text-based

quiz

question.


Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1 when ultra-light mode is enabled allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message aka SPR TCLE98ZKRP.


Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.11.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via (1) the Search field in an inbox action to messaging/messagebox.php (2) the \First name\ field to auth/profile.php or (3) the Speakers field in an rqAdd action to calendar/agenda.php.


Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier and the ePO Extension for the McAfee Agent (MA) 4.5 through 4.6 allow remote attackers to inject arbitrary web script or HTML via the (1) instanceId parameter core/loadDisplayType.do; (2) instanceId or (3) monitorUrl parameter to console/createDashboardContainer.do; uid parameter to (4) ComputerMgmt/sysDetPanelBoolPie.do or (5) ComputerMgmt/sysDetPanelSummary.do; (6) uid (7) orion.user.security.token or (8) ajaxMode parameter to ComputerMgmt/sysDetPanelQry.do; or (9) uid (10) orion.user.security.token or (11) ajaxMode parameter to ComputerMgmt/sysDetPanelSummary.do.


Cross-site scripting (XSS) vulnerability in the zen_breadcrumb function in template.php in the Zen theme 6.x-1.x 7.x-3.x before 7.x-3.2 and 7.x-5.x before 7.x-5.4 for Drupal allows remote authenticated users with the \administer themes\ permission to inject arbitrary web script or HTML via the breadcrumb separator field.


Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1 FP13 and IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 FP7 and 11.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in adv_sw.php in the Advanced Management Module (AMM) with firmware BBET before BBET64G and BPET before BPET64G for IBM BladeCenter systems allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in repo/includes/EntityView.php in the Wikibase extension for MediaWiki 1.19.x before 1.19.8 1.20.x before 1.20.7 and 1.21.x before 1.21.2 allow (1) remote attackers to inject arbitrary web script or HTML via a label in the \In other languages\ section or (2) remote administrators to inject arbitrary web script or HTML via a description.


The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XSS) attacks via an unclosed HTML tag.


includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8 1.20.x before 1.20.7 and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of \.\ (period) characters in a string which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.


Multiple cross-site scripting (XSS) vulnerabilities in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a (1) custom-reports generation page (2) Storage Devices creation page or (3) jobs creation page in the management console; or (4) a Backup Exec server-management page in the beutility console.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

Magnolia

Form

module

before

and

before

for

Magnolia

CMS

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

username

fullname

or

email

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title) value.


Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1 as used in Moodle through 2.1.10 2.2.x before 2.2.11 2.3.x before 2.3.8 2.4.x before 2.4.5 2.5.x before 2.5.1 and other products allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.


Cross-site scripting (XSS) vulnerability in the UDDI Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 7.0 before 7.0.0.31 8.0 before 8.0.0.8 and 8.5 before 8.5.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Alkacon

OpenCms

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

title

parameter

to

or

the

requestedResource

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities in the signin functionality of ics in MyTeamwork services in Alcatel-Lucent Omnitouch 8660 My Teamwork before 6.7 Omnitouch 8670 Automated Message Delivery System (AMDS) before 6.7 Omnitouch 8460 Advanced Communication Server before 9.1 and OmniTouch 8400 Instant Communications Suite before 6.7.3 (1) allow remote attackers to inject arbitrary web script or HTML via a crafted URL that results in a reflected XSS or (2) allow user-assisted remote attackers to inject arbitrary web script or HTML via a user's personal bookmark entry that results in a stored XSS via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the MediaFront module 6.x-1.x before 6.x-1.6 7.x-1.x before 7.x-1.6 and 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the \administer mediafront\ permission to inject arbitrary web script or HTML via the preset settings.


Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py (2) pts.py and (3) request.py in Plone 2.1 through 4.1 4.2.x through 4.2.5 and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9 1.20.x before 1.20.8 and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS as demonstrated using variations of \expression\ containing (1) full width characters or (2) IPA extensions which are converted and rendered by Internet Explorer.


Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 7.0 before 7.0.0.31 8.0 before 8.0.0.7 and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified fields.


Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1 as used in Moodle through 2.1.10 2.2.x before 2.2.11 2.3.x before 2.3.8 2.4.x before 2.4.5 2.5.x before 2.5.1 and other products allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Spacewalk

and

Red

Hat

Network

(RHN)

Satellite

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

whereCriteria

variable

in

a

software

channels

search;

optionScanDateSearch

or

whereToSearch

variable

in

an

scap

audit

results

search;

fineGrained

optionIssueDateSearch

or

variable

in

an

errata

search;

or

fineGrained

variable

in

a

systems

search

related

to


Multiple cross-site scripting (XSS) vulnerabilities in BMC Service Desk Express (SDE) 10.2.1.95 allow remote attackers to inject arbitrary web script or HTML via the (1) SelTab parameter to QV_admin.aspx the (2) CallBack parameter to QV_grid.aspx or the (3) HelpPage parameter to commonhelp.aspx.


The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations which makes it easier for remote authenticated users with the \access resource node\ and \create page content\ permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.


Cross-site scripting (XSS) vulnerability in core/handleTw.php on the Siemens Enterprise OpenScape Branch appliance and OpenScape Session Border Controller (SBC) before 2 R0.32.0 and 7 before 7 R1.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

Scald

module

before

for

Drupal

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

in

the

function

in

or

the

caption

in

the

function

in


Multiple cross-site scripting (XSS) vulnerabilities in Jahia xCM 6.6.1.0 before hotfix 7 allow remote attackers to inject arbitrary web script or HTML via (1) the site parameter to engines/manager.jsp (2) the searchString parameter to administration/ in a search action or the (3) username (4) firstName (5) lastName (6) email or (7) organization field to administration/ in a users action.


Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virtualization Manager (RHEV-M) as used in Red Hat Enterprise Virtualization 3 and 3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Admin/login/default.asp in DDSN Interactive cm3 Acora CMS 6.0.6/1a 6.0.2/1a 5.5.7/12b 5.5.0/1b-p1 and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) username (2) url (3) qstr parameter.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name (2) a crafted user name (3) a crafted logo URL in the navigation panel (4) a crafted entry in a certain proxy list or (5) crafted content in a version.json file.


Cross-site scripting (XSS) vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to inject arbitrary web script or HTML via a crafted DHCP Host Name option which is not properly handled during rendering of the DHCP table in wlanAccess.asp.


Multiple cross-site scripting (XSS) vulnerabilities in the Freichat (com_freichat) component possibly 9.4 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) xhash parameter to client/chat.php or (3) toname parameter to client/plugins/upload/upload.php.


Cross-site scripting (XSS) vulnerability in the displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to inject arbitrary web script or HTML by leveraging incorrect handling of error-message output.


Cross-site scripting (XSS) vulnerability in the Local Management Interface (LMI) in IBM Security Network Protection on XGS 5100 devices with firmware 5.1 before 5.1.0.6 and 5.1.1 before 5.1.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Mobile Safari in Apple iOS before 7 does not prevent HTML interpretation of a document served with a text/plain content type which allows remote attackers to conduct cross-site scripting (XSS) attacks by uploading a file.


Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 12 9.0.1 before Update 11 9.0.2 before Update 6 and 10 before Update 12 when the CFIDE directory is available allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the logviewer directory.


Cross-site scripting (XSS) vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote attackers to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form.


Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to error messages and (1) crafted event attributes or (2) > (greater than) characters that are optional within a browser's HTML implementation a different issue than CVE-2013-3603.


Cross-site

scripting

(XSS)

vulnerability

in

in

phpMyAdmin

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

object

name

associated

with

a

TextLinkTransformationPlugin

link.


Multiple cross-site scripting (XSS) vulnerabilities in ajaxRequest/methodCall.do in Tripwire Enterprise 8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) m_target_class_name (2) m_target_method_name or (3) m_request_context_params parameters.


Multiple cross-site scripting (XSS) vulnerabilities in tmpl/layout_editevent.php in the Multi Calendar (com_multicalendar) component 4.0.2 and possibly 4.8.5 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) calid or (2) paletteDefault parameter in an editevent action to index.php.


Cross-site scripting (XSS) vulnerability in Microsoft ASP.NET SignalR 1.1.x before 1.1.4 and 2.0.x before 2.0.1 and Visual Studio Team Foundation Server 2013 allows remote attackers to inject arbitrary web script or HTML via crafted Forever Frame transport protocol data aka \SignalR XSS Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in bb_admin.php in MiniBB before 3.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) forum_name (2) forum_group (3) forum_icon or (4) forum_desc parameter. NOTE: the whatus vector is already covered by CVE-2008-2066.


Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31 8.0 before 8.0.0.8 and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.


Cross-site scripting (XSS) vulnerability in the search implementation in IBM Rational Quality Manager (RQM) 2.0 through 2.0.1.1 3.x before 3.0.1.6 iFix 1 and 4.x before 4.0.5 as used in Rational Team Concert Rational Requirements Composer and other products allows remote authenticated users to inject arbitrary web script or HTML via vectors involving an IFRAME element.


Multiple cross-site scripting (XSS) vulnerabilities in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.1 before 7.1r15 7.2 before 7.2r11 7.3 before 7.3r6 and 7.4 before 7.4r3 allow (1) remote attackers to inject arbitrary web script or HTML via vectors involving login pages and allow (2) remote authenticated users to inject arbitrary web script or HTML via vectors involving a support page.


Cross-site scripting (XSS) vulnerability in the Resource Manager in the MEE submodule (mee.module) in the Scald module 6.x-1.x before 6.x-1.0-beta3 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the atom title a different vector than CVE-2013-4174.


Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13 when MakeClicky is configured allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions.


Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/auditlog/ (2) PATH_INFO to info/host/ or (3) viewport/ (4) back parameter to login or (5) \from\ parameter to status/service/recheck.