Cross-site scripting (XSS) vulnerability in the phptemplate_preprocess_node function in template.php in the Inf08 theme 6.x-1.x before 6.x-1.10 for Drupal allows remote authenticated users with the \administer taxonomy\ permission to inject arbitrary web script or HTML via a taxonomy vocabulary name.


Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.


Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1 3.1.2 3.2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Email Address or (2) Custom Permalink Structure fields in admin/settings.php; (3) path parameter to admin/upload.php; (4) err parameter to admin/theme.php; (5) error parameter to admin/pages.php; or (6) success or (7) err parameter to admin/index.php.


Multiple cross-site scripting (XSS) vulnerabilities in FreeNAC 3.02 allow remote attackers to inject arbitrary web script or HTML via the (1) comment (2) mac (3) graphtype (4) name or (5) type parameter to stats.php; or (6) comment parameter to deviceadd.php.


Multiple cross-site scripting (XSS) vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script or HTML via (1) the p parameter in the getMenus function in codes/wcms.php; or the COMMENT parameter in (2) blog.php (3) guestbook.php or (4) forum.php in codes/. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the Troubleshooting Reporting System feature in AgileBits 1Password 3.9.9 might allow remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header that is not properly handled in a View Troubleshooting Report action.


Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher) or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.


Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute which is not properly handled in the autocomplete combo box demo.


Multiple cross-site scripting (XSS) vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) subject or (2) content values of a note in a system.addNote XML-RPC call.


Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_campName to admin/create_campaign.php or (2) admin/edit_campaign.php (3) xyz_em_email parameter to admin/edit_email.php (4) xyz_em_exportbatchSize parameter to import_export.php or (5) pagination limit in the Newsletter Manager options.


Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) bulk parameter to media-library-categories/add.php or (2) q parameter to media-library-categories/view.php.


Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php which is not properly handled in the snippet preview functionality.


Multiple cross-site scripting (XSS) vulnerabilities in the web-authentication function on the Cisco NAC Appliance 4.9.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) cm or (2) uri parameters to (a) perfigo_weblogin.jsp or the (3) cm (4) provider (5) session (6) uri (7) userip or (8) username parameters to (b) perfigo_cm_validate.jsp aka Bug ID CSCud15109.


Multiple cross-site scripting (XSS) vulnerabilities in the TP-LINK TL-WR841N router with firmware 3.13.9 Build 120201 Rel.54965n and earlier allow remote administrators to inject arbitrary web script or HTML via the (1) username or (2) pwd parameter to userRpm/NoipDdnsRpm.htm.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Dell

OpenManage

Server

Administrator

and

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

topic

parameter

to

in

help/sm/en/Output/wwhelp/wwhimpl/js/

help/sm/es/Output/wwhelp/wwhimpl/js/

help/sm/ja/Output/wwhelp/wwhimpl/js/

help/sm/de/Output/wwhelp/wwhimpl/js/

help/sm/fr/Output/wwhelp/wwhimpl/js/

help/sm/zh/Output/wwhelp/wwhimpl/js/

help/hip/en/msgguide/wwhelp/wwhimpl/js/

or

help/hip/en/msgguide/wwhelp/wwhimpl/common/.


Cross-site scripting (XSS) vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in ClipBucket 2.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter to view_channel.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0 possibly as downloaded before December 19 2012 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin.php. NOTE: this might be a duplicate of CVE-2008-4140.


Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize to the displayCRL script or (3) nonce variable to the profileProcess script.


Multiple cross-site scripting (XSS) vulnerabilities in the galleryformatter_field_formatter_view functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject arbitrary web script or HTML via the (1) title or (2) alt parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Title (2) Content or (3) New category field to wordpress/ or (4) query string to wordpress/.


Cross-site scripting (XSS) vulnerability in the web management interface on Polycom HDX Video End Points with UC APL software before 2.7.1.1_J and commercial software before 3.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

bad-behavior-wordpress-admin.php

in

the

Bad

Behavior

plugin

before

and

before

for

WordPress

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

parameter.


Multiple cross-site scripting (XSS) vulnerabilities in servlet/traveler/ILNT.mobileconfig in IBM Lotus Notes Traveler before 8.5.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) userId or (2) address parameter in a getClientConfigFile action.


Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted string to the AbsoluteLinks (2) BigSummary (3) ContextSummary (4) EscapeXML (5) FirstParagraph (6) FirstSentence (7) Initial (8) LimitCharacters (9) LimitSentences (10) LimitWordCount (11) LimitWordCountXML (12) Lower (13) LowerCase (14) NoHTML (15) Summary (16) Upper (17) UpperCase or (18) URL method in a template different vectors than CVE-2012-0976.


Multiple cross-site scripting (XSS) vulnerabilities in Endian Firewall 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) createrule parameter to dnat.cgi (2) addrule parameter to dansguardian.cgi or (3) PATH_INFO to openvpn_users.cgi.


Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to inject arbitrary web script or HTML via a crafted signature in an HTML e-mail message.


Multiple cross-site scripting (XSS) vulnerabilities in Barracuda SSL VPN before 2.2.2.203 (2012-07-05) allow remote attackers to inject arbitrary web script or HTML via the (1) policyLaunching (2) resourcePrefix or (3) actionPath parameter in showUserResourceCategories.do; (4) list or (5) path parameter to fileSystem.do; or (6) return-To parameter to launchAgent.do.


The HZ-GB-2312 character-set implementation in Mozilla Firefox before 17.0 Firefox ESR 10.x before 10.0.11 Thunderbird before 17.0 Thunderbird ESR 10.x before 10.0.11 and SeaMonkey before 2.14 does not properly handle a ~ (tilde) character in proximity to a chunk delimiter which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.


Opera before 12.01 on Windows and UNIX and before 11.66 and 12.x before 12.01 on Mac OS X ignores some characters in HTML documents in unspecified circumstances which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.


Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to inject arbitrary web script or HTML via the full_name parameter in a moduser action to admin/admin.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Stoneware webNetwork 6.1 before SP1 allow remote attackers to inject arbitrary web script or HTML via the blogName parameter to (1) community/blog.jsp or (2) community/blogSearch.jsp the (3) calendarType or (4) monthNumber parameter to community/calendar.jsp or the (5) flag parameter to swDashboard/ajax/setAppFlag.jsp.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ownCloud

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

file

names

to

url

or

title

parameter

to

tag

or

page

parameter

to

identity

to

stack

name

in

root

parameter

to

calendar

displayname

in

calendar

uri

in

title

location

or

description

parameter

in

certain

vectors

in

or

artist

album

or

title

comments

parameter

in


Cross-site scripting (XSS) vulnerability in the comments module in the RSGallery2 (com_rsgallery2) component before 2.3.0 for Joomla! 1.5.x and before 3.2.0 for Joomla! 2.5.x allows remote attackers to inject arbitrary web script or HTML via crafted BBCode markup in a comment.


Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.5 through Patch 6 and 5.6 through Patch 3 and McAfee Email Gateway (MEG) 7.0.0 and 7.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to the McAfee Security Appliance Management Console/Dashboard.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Zend

Framework

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

input

to

Debug

Feed\\PubSubHubbub

Log\\Formatter\\Xml

Tag\\Cloud\\Decorator

Uri

View\\Helper\\HeadStyle

View\\Helper\\Navigation\\Sitemap

or

View\\Helper\\Placeholder\\Container\\AbstractStandalone

related

to

Escaper.


Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS 2012-03.08 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title_en (2) summary_en or (3) body_en parameter in a submitnews action to the news module a different vulnerability than CVE-2012-4890. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to \server variables \ a different vulnerability than CVE-2012-4263.


Cross-site scripting (XSS) vulnerability in InfoSphere Business Glossary 8.1.1 and 8.1.2 InfoSphere DataStage Operation Console InfoSphere Administration and Reporting and Repository Management Web Console in IBM InfoSphere Information Server 8.1 8.5 before FP3 and 8.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ownCloud

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

calendar

displayname

to

part.choosecalendar.rowfields.php

or

part.choosecalendar.rowfields.shared.php

in

apps/calendar/templates/;

or

unspecified

vectors

to


Cross-site scripting (XSS) vulnerability in the Keyword Search page in the web interface in Pattern Insight 2.3 allows remote attackers to inject arbitrary web script or HTML via crafted characters that are not properly handled during construction of error messages.


Multiple cross-site scripting (XSS) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to index.php (2) phase parameter to install.php (3) tablename or (4) dbid parameter to sql.php or (5) filename parameter to restore.php in learn/cubemail/.


Multiple cross-site scripting (XSS) vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attackers to inject arbitrary web script or HTML via (1) the having parameter in a manage action to index.php; (2) the Email field in an Add User action; (3) the Customer Name field in an Add Customer action; the (4) Street address (5) Street address 2 (6) City (7) Zip code (8) State (9) Country (10) Mobile Phone (11) Phone (12) Fax (13) Email (14) PayPal business name (15) PayPal notify url (16) PayPal return url (17) Eway customer ID (18) Custom field 1 (19) Custom field 2 (20) Custom field 3 or (21) Custom field 4 field in an Add Biller action; (22) the Customer field in an Add Invoice action; the (23) Invoice or (24) Notes field in a Process Payment action; (25) the Payment type description field in a Payment Types action; (26) the Description field in an Invoice Preferences action; (27) the Description field in a Manage Products action; or (28) the Description field in a Tax Rates action.


Multiple cross-site scripting (XSS) vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) notes parameter to (a) admin/agenteditor.php; (2) title (3) previewdesc (4) fulldesc or (5) notes parameter (b) to agentadmin.php or (c) in an addlisting action to agentadmin.php; or unspecified vectors to (d) admin/adminfeatures.php.


Cross-site scripting (XSS) vulnerability in the administrative interface in the Campaign Monitor module before 6.x-2.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this refers to an issue in an independently developed Drupal module and NOT an issue in the Campaign Monitor software itself (described on the campaignmonitor.com web site).


Cross-site scripting (XSS) vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal when \Log failed hashcash\ is enabled allows remote attackers to inject arbitrary web script or HTML via an invalid token which is not properly handled when administrators use the Database logging module.


Multiple cross-site scripting (XSS) vulnerabilities in Microcart 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO or (2) query string to _admin/index.php or (3) first_name (4) last_name (5) cc (6) exp (7) cvv (8) address1 (9) address2 (10) city (11) state (12) zip (13) phone or (14) email parameter to checkout.php which is not properly handled in an error message.


Cross-site scripting (XSS) vulnerability in the contacts in (1) XPhone UC Web and the (2) web frontend for XPhone Virtual Directory in C4B XPhone Unified Communications (UC) 2011 Web 4.1.890S R1 allows remote attackers to inject arbitrary web script or HTML via the company name. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Foundations Start before 1.2.2c allow remote authenticated users to inject arbitrary web script or HTML via a Webconfig Users user-attribute field as demonstrated by the (1) First Name or (2) Last Name field.


Cross-site scripting (XSS) vulnerability in the Custom Publishing Options module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the \administer nodes\ permission to inject arbitrary web script or HTML via the status labels parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) admin/accounts/ (2) admin/manage/ or (3) admin/manage/blocks/edit/; or (4) group parameter to admin/configuration/. NOTE: The faccountsfullname and faccountsusername vectors are covered in CVE-2012-5452.


Cross-site scripting (XSS) vulnerability in modules/mod_languages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations (1) TRUNCATE or (2) DROP link for a crafted table name (3) the Add Trigger popup within a Triggers page that references crafted table names (4) an invalid trigger-creation attempt for a crafted table name (5) crafted data in a table or (6) a crafted tooltip label name during GIS data visualization a different issue than CVE-2012-4345.


Cross-site scripting (XSS) vulnerability in global-protect/login.esp in Palo Alto Networks Global Protect Portal Global Protect Gateway and SSL VPN portals 3.1.x through 3.1.11 and 4.0.x through 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the inputStr parameter in a Login action.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

parameter

to

favorites

or

lang

parameter

to

aktion

or

callurl

parameter

to

or

ln

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities in the Shorten URLs module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors to the (1) report or (2) Custom Services List page.


Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1 10.1 before IF2 10.1.1 before IF2 and 10.2 before IF1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted string that is not properly handled during rendering of stored data.


Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user (2) remote_database (3) remote_userprefix (4) remote_password or (5) remote_prefix parameter to the import4 page; or the (6) id parameter to the bouncerule page.


Multiple cross-site scripting (XSS) vulnerabilities in SquidClamav 5.x before 5.8 allow remote attackers to inject arbitrary web script or HTML via the (1) url (2) virus (3) source or (4) user parameter to (a) clwarn.cgi (b) clwarn.cgi.de_DE (c) clwarn.cgi.en_EN (d) clwarn.cgi.fr_FR (e) clwarn.cgi.pt_BR or (f) clwarn.cgi.ru_RU in cgi-bin/.


Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3 and McAfee Email Gateway (MEG) 7.0 before Patch 1 allows remote attackers to inject arbitrary web script or HTML via vectors related to the McAfee Security Appliance Management Console/Dashboard.


Cross-site scripting (XSS) vulnerability in the Sleipnir Mobile application 2.2.0 and earlier and Sleipnir Mobile Black Edition application 2.2.0 and earlier for Android allows remote attackers to inject arbitrary web script or HTML via a crafted application that interacts with an unspecified Sleipnir Mobile function.


Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.


Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x and 4.2.x before 4.2.4 and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report as demonstrated by the Version field.


The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2 Firefox ESR 10.x before 10.0.10 Thunderbird before 16.0.2 Thunderbird ESR 10.x before 10.0.10 and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site and makes it easier for remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior.


Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the \processing of the buttons of Xing and Pinterest\.


Cross-site

scripting

(XSS)

vulnerability

in

the

function

in

in

FCKeditor

and

earlier

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

textinputs

array

parameters.


Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation or a (2) Empty link or (3) Drop link for a crafted table name.


Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15 3.0.x before 3.0.17 and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element as demonstrated by an IFRAME element.


Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer (3) status or (4) testtarget parameter in the send page.


Cross-site

scripting

(XSS)

vulnerability

in

the

function

in

in

Smarty

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors.


Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to panel/index_amp.php or (2) panel/dhtml/index.php; (3) clid or (4) clidname parameters to panel/flash/mypage.php; (5) PATH_INFO to admin/views/freepbx_reload.php; or (6) login parameter to recordings/index.php.


Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14 3.0.x before 3.0.16 and 3.1.x before 3.1.10 when Firefox or Opera is used allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with nested HTML tags.


Mozilla Firefox before 16.0.2 Firefox ESR 10.x before 10.0.10 Thunderbird before 16.0.2 Thunderbird ESR 10.x before 10.0.10 and SeaMonkey before 2.13.2 do not prevent use of the valueOf method to shadow the location object (aka window.location) which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Layton

Helpbox

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

parameter

to

writesolutionuser.asp

or

the

parameter

to

deletesolution.asp.


Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the \Search for an IP address\ field.


Mozilla Firefox before 17.0 Firefox ESR 10.x before 10.0.11 Thunderbird before 17.0 Thunderbird ESR 10.x before 10.0.11 and SeaMonkey before 2.14 do not prevent use of a \top\ frame name-attribute value to access the location property which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a binary plugin.


Cross-site scripting (XSS) vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter a different vector than CVE-2012-4889. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the \3 slide gallery\ in the Elegant Theme module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the \administer themes\ permission to inject arbitrary web script or HTML via a slide URL.


Cross-site scripting (XSS) vulnerability in the \extra\ details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the \function name\ line.


Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) subTab or (2) tab parameter to createAnomaly.do; (3) url (4) subTab or (5) tab parameter to mindex.do; (6) tab parameter to index2.do; or (7) port parameter to syslogViewer.do.


Cross-site scripting (XSS) vulnerability in the administrative interface in the Better Revisions module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the \administer better revisions\ permission to inject arbitrary web script or HTML via unspecified vectors.


The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors as demonstrated using a textarea element.


Opera before 12.01 on Windows and UNIX and before 11.66 and 12.x before 12.01 on Mac OS X does not properly escape characters in DOM elements which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted HTML document.


The evalInSandbox implementation in Mozilla Firefox before 17.0 Firefox ESR 10.x before 10.0.11 Thunderbird before 17.0 Thunderbird ESR 10.x before 10.0.11 and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property which allows remote attackers to conduct cross-site scripting (XSS) attacks or read arbitrary files by leveraging a sandboxed add-on.


Cross-site scripting (XSS) vulnerability in wp-live.php in the WP Live.php module 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/index.php or the (2) username or (3) password parameter in blocks/loginbox/loginbox.template.php to index.php. NOTE: some of these details are obtained from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ownCloud

before

and

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

file

name

to

or

or

event

title

to


Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0 as used in Bugzilla 3.7.x and 4.0.x before 4.0.9 4.1.x and 4.2.x before 4.2.4 and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore.swf a similar issue to CVE-2010-4209.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

IBM

TRIRIGA

Application

Platform

and

before

and

allow

remote

attackers

to

inject

content

and

conduct

phishing

attacks

via

vectors

involving

the

html/en/default/

directory

birt/frameset

WebProcess.srv

or


Cross-site scripting (XSS) vulnerability in the help page in Juniper Secure Access (SA) with IVE OS before 7.1r13 7.2.x before 7.2r7 and 7.3.x before 7.3r2 allows remote attackers to inject arbitrary web script or HTML via the WWHSearchWordsText parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17 as used in Horde Groupware Webmail Edition before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) tasks view or (2) search view.


Multiple cross-site scripting (XSS) vulnerabilities in GreenBrowser 6.1.0117 and 6.1.0216 allow remote attackers to inject arbitrary web script or HTML via (1) the URI in an about: page or (2) the last visited URL in the LastVisitWriteEn function in function.js.


Multiple cross-site scripting (XSS) vulnerabilities in the OM Maximenu module 6.x-1.x before 6.x-1.44 and 7.x-1.x before 7.x-1.44 for Drupal allow remote authenticated users with the \administer OM Maximenu\ permission to inject arbitrary web script or HTML via the (1) Menu Title (2) Link Title (3) Path Query (4) Anchor or (5) vocabulary names.


Multiple cross-site scripting (XSS) vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to calc.php (2) chat.php (3) register.php or (4) index.php in libs/smarty_ajax/; or the (5) page parameter to libs/smarty_ajax/index.php.


Multiple cross-site scripting (XSS) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3 and 8 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) WebProcess.srv (2) the html/en/default/ directory (3) Widget/resource (4) birt/frameset or (5) ganttlib/gantt-jws.jnlp.


Multiple cross-site scripting (XSS) vulnerabilities in Health Monitor Login pages in Cisco Prime Network Control System (NCS) and Wireless Control System (WCS) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors aka Bug ID CSCud18375.


Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18 as used in Horde Groupware Webmail Edition before 4.0.9 allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month (2) monthlist or (3) prevmonthlist fields related to portal blocks.


Cross-site scripting (XSS) vulnerability in the settings page (admin/settings/hotblocks) in the Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the \administer hotblocks\ permission to inject arbitrary web script or HTML via the \block names.\


Multiple cross-site scripting (XSS) vulnerabilities in the scr_do_redirect function in scr.php in the Shortcode Redirect plugin 1.0.01 and earlier for WordPress allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (1) url or (2) sec attributes in a redirect tag.


Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) stats/index.php or (2) newsletters/edition.php or the (3) username parameter to users/remind_password.php (4) days parameter to stats/index.php (5) login parameter to users/register.php or (6) highlight parameter.


Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal when the field has \Reference existing\ source enabled allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.


Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) multi_title parameter to blocks/add/; (2) cost (3) days or (4) titleen parameter to plans/add/; (5) name or (6) titleen parameter to fields/group/add/ in admin/manage/; or (7) faccountsfullname or (8) faccountsusername parameter to advsearch/. NOTE: This might overlap CVE-2011-5211. NOTE: it was later reported that the faccountsfullname and faccountsusername vectors might also affect 2.2.2.


Cross-site scripting (XSS) vulnerability in HP Intelligent Management Center (iMC) and Intelligent Management Center for Automated Network Manager (ANM) before 5.2 E0401 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) find or (2) replace fields to havalite/findReplace.php; (3) username parameter to havalite/hava_login.php (4) the Edit Article module or (5) hava_post.php in the postAuthor module; (6) postId parameter to hava_post.php; (7) userId parameter to hava_user.php; or (8) linkId parameter to hava_link.php.


Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24 as used in Horde Groupware Webmail Edition before 4.0.9 allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file related to the dynamic view.


Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web script or HTML via fields in XML asset data to discoveryServlet/WsDiscoveryServlet as demonstrated by the DocRoot/Computer_Information/output element.


Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term parameter to (1) autocomplete.php (2) search/ajax/autosuggest.php (3) livesuggest.php or (4) save.php in frontend/modules/search/ajax.


Cross-site scripting (XSS) vulnerability in Google Web Toolkit (GWT) 2.4 through 2.5 Final as used in JBoss Operations Network (ON) 3.1.1 and possibly other products allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2012-4563.


Cross-site scripting (XSS) vulnerability in the Data Management Portal Web User Interface in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.x before 7.2.1.4 allows remote authenticated users to inject content and conduct phishing attacks via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Barracuda Spam & Virus Firewall 600 Firmware 4.0.1.009 and earlier allow remote authenticated users to inject arbitrary web script or HTML via (1) Troubleshooting in the Trace route Device module or (2) LDAP Username in the LDAP Configuration module.


Cross-site scripting (XSS) vulnerability in the Receiver Web User Interface on Trimble Infrastructure GNSS Series Receivers NetR3 NetR5 NetR8 and NetR9 before 4.70 and NetRS before 1.3-2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows remote authenticated users with the \administer smiley\ permission to inject arbitrary web script or HTML via a smiley acronym.


Multiple cross-site scripting (XSS) vulnerabilities in statistik.php in Otterware StatIt 4 allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter (2) show parameter in a stat_tld action or (3) order parameter in a stat_abfragen action.


Multiple cross-site scripting (XSS) vulnerabilities in Craig Knudsen WebCalendar allow remote attackers to inject arbitrary web script or HTML via the (1) $name or (2) $description variables in edit_entry_handler.php or (3) $url (4) $tempfullname or (5) $ext_users variables in view_entry.php different vectors than CVE-2012-0846.


Multiple cross-site scripting (XSS) vulnerabilities in the ShareThis module 7.x-2.x before 7.x-2.5 for Drupal allow remote authenticated users with the \administer sharethis\ permission to inject arbitrary web script or HTML via unspecified vectors related to \JavaScript settings.\


Cross-site scripting (XSS) vulnerability in Welcome.do in the Data Management Portal Web User Interface in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.x before 7.2.1.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the page manager node view task in the Chaos tool suite (ctools) module 6.x-1.x before 6.x-1.10 for Drupal allows remote authenticated users with permissions to submit or edit nodes to inject arbitrary web script or HTML via the page title.


Mozilla Firefox before 17.0 Firefox ESR 10.x before 10.0.11 Thunderbird before 17.0 Thunderbird ESR 10.x before 10.0.11 and SeaMonkey before 2.14 implement cross-origin wrappers with a filtering behavior that does not properly restrict write actions which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.


Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) callback parameter in a color_selector action (2) field parameter in a date_format action or (3) company_name parameter in an addedit action to index.php. NOTE: the date parameter vector is already covered by CVE-2008-3886.


Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the OTR_HEADS parameter in an edit action. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the sed_import function in system/functions.php in Neocrome Seditio build 160 and 161 allow remote attackers to inject arbitrary web script or HTML via the (1) newmsg or (2) rtext parameter. NOTE: some of these details are obtained from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ownCloud

Server

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

readyCallback

parameter

to

the

root

parameter

to

or

a

malformed

query

to

lib/db.php.


Cross-site scripting (XSS) vulnerability in the Twitter Pull module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.0-rc3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to \data coming from Twitter.\


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Xavi

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

pvcName

parameter

to

webconfig/wan/confirm.html/confirm

or

parameter

to

webconfig/lan/lan_config.html/local_lan_config.


The Web Developer Toolbar in Mozilla Firefox before 17.0 executes script with chrome privileges which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.


Cross-site scripting (XSS) vulnerability in servlet/traveler in IBM Lotus Notes Traveler before 8.5.3.3 Interim Fix 1 when Firefox is used allows remote attackers to inject arbitrary web script or HTML via the redirectURL parameter a different vulnerability than CVE-2012-4824 and CVE-2012-4825.


Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9 2.10.17 and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third party information.


html/parser/XSSAuditor.cpp in WebCore in WebKit as used in Google Chrome through 22 and Safari 5.1.7 does not consider all possible output contexts of reflected data which makes it easier for remote attackers to bypass a cross-site scripting (XSS) protection mechanism via a crafted string aka rdar problem 12019108.


Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php a related issue to CVE-2012-5387.


Multiple cross-site scripting (XSS) vulnerabilities in the MailChimp module 7.x-2.x before 7.x-2.7 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) a predictable \webhook URL key\ and (2) improper sanitization of \Webhook variables from POST requests.\


A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier 2.121.1 and earlier in BuildTimelineWidget.java BuildTimelineWidget/control.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.


A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.


A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in another user's browser when that other user views HTTP 404 error pages while Stapler debug mode is enabled.


The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.


SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via URL path and HTTP POST parameter.


A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QTS 4.5.1.1456 build 20201015 (and later) QTS 4.3.6.1446 build 20200929 (and later) QTS 4.3.4.1463 build 20201006 (and later) QTS 4.3.3.1432 build 20201006 (and later) QTS 4.2.6 build 20210327 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.4.1601 build 20210309 (and later) QuTScloud c4.5.3.1454 build 20201013 (and later)


If exploited this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later


Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting.


If exploited this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.


PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via the URL field in index.php.


Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTML into the Website Blocking page by inserting arbitrary HTML into the 'TodUrlAdd' URL parameter in a /urlfilter.cmd POST request.


OSIsoft PI Vision versions PI Vision 2017 and PI Vision 2017 R2 The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected. This vulnerability requires the ability of authorized AF users to store JavaScript in AF elements and attributes.


Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.


An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.


Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.


A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scripting (UXSS) condition aka \Internet Explorer Security Feature Bypass Vulnerability.\ This affects Internet Explorer 11.


The getTip() method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks even when passed HTML-escaped data. This framework brings no built-in XSS protection so the developer has to ensure that data is correctly sanitized. However the getTip() method of Action Columns takes HTML-escaped data and un-escapes it. If the tooltip contains user-controlled data an attacker could exploit this to create a cross-site scripting attack even when developers took precautions and escaped data.


Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator.


The License Manager service of HASP SRM Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability.


A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator.


vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List (app parameter).


Cross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows remote authenticated users to inject arbitrary web script or HTML via the (1) family_name (2) given_name or (3) additional_name parameter.


AbanteCart 1.2.12 has reflected cross-site scripting (XSS) via the sort parameter as demonstrated by a /apparel--accessories?sort= substring.


A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials. Affected releases are Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1.


Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters.


An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter.


LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload resulting in Javascript code execution against LimeSurvey administrators. Fixed in version 3.15.6.


Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g. writing javascript as javascri%0apt).


PHP Scripts Mall Advance B2B Script 2.1.4 has stored Cross-Site Scripting (XSS) via the FIRST NAME or LAST NAME field.


bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter.


Podcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter.


An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent password update. The affected forms are also vulnerable to Reflected Cross-Site Scripting vulnerabilities. This flaw could be triggered by driving an administrator logged into the Eaton application to a specially crafted web page. This attack could be done silently.


A vulnerability in the conferencing component of Mitel MiVoice Connect versions R1707-PREM SP1 (21.84.5535.0) and earlier and Mitel ST 14.2 versions GA27 (19.49.5200.0) and earlier could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the api.php page. A successful exploit could allow an attacker to execute arbitrary scripts.


For some Iomega Lenovo LenovoEMC NAS devices versions 4.1.402.34662 and earlier the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name and wait for a user to try and rename the file for their payload to trigger.


iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the \Site Description\ field.


iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the \Site title\ field.


A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.


A vulnerability in the conferencing component of Mitel MiVoice Connect versions R1707-PREM SP1 (21.84.5535.0) and earlier and Mitel ST 14.2 versions GA27 (19.49.5200.0) and earlier could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the launch_presenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts.


Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31 7.8.x before 7.8.2-rev31 7.8.3 before 7.8.3-rev41 and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page with data-toggle gadgets.


A vulnerability in the conferencing component of Mitel MiVoice Connect versions R1707-PREM SP1 (21.84.5535.0) and earlier and Mitel ST 14.2 versions GA27 (19.49.5200.0) and earlier could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit could allow an attacker to execute arbitrary scripts.


An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities in the firstname lastname billing_address-address billing_address-zipcode billing_address-city billing_address-department shipping_address-address shipping_address-zipcode shipping_address-city and shipping_address-department parameters in the contact creation and modification page. The payload is stored within the application database and allows the execution of JavaScript code each time a client visit an infected page.


Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component as demonstrated by the Admin->Logs section (with a logs?logs.type= URI) and the Manage->Attributes section (via the \Name (display)\ field to the attributes/create URI).


Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2) as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products allows remote attackers to inject arbitrary web script through a crafted IMG element.


iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.


and

in

Advanced

Comment

System

version

contain

a

reflected

cross-site

scripting

vulnerability

via

A

remote

unauthenticated

attacker

could

potentially

exploit

this

vulnerability

to

supply

malicious

HTML

or

JavaScript

code

to

a

vulnerable

web

application

which

is

then

reflected

back

to

the

victim

and

executed

by

the

web

browser.

The

product

is

discontinued.


The web application of the TIBCO Statistica component of TIBCO Software Inc.'s TIBCO Statistica Server contains vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Statistica Server versions up to and including 13.4.0.


The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web listing of a remote FTP server. Exploiting the vulnerability requires the attacker to be able to upload crafted files to the remote FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15 6.6 and 6.7 prior to 6.7.4.2.


A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.


The Spotfire web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that may allow persistent and reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc. TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.0.0 and TIBCO Spotfire Server: versions up to and including 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0; 10.0.0.


A reflected Cross-Site scripting (XSS) vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the Login Form.


Norton Password Manager for Android (formerly Norton Identity Safe) may be susceptible to a cross site scripting (XSS) exploit which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.


A stored cross-site scripting (XSS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisition module 1.05 with firmware revision v1.05. An authenticated user can inject arbitrary script via setup.html in the web interface.


Tridium Niagara Enterprise Security 2.3u1 all versions prior to 2.3.118.6 Niagara AX 3.8u4 all versions prior to 3.8.401.1 Niagara 4.4u2 all versions prior to 4.4.93.40.2 and Niagara 4.6 all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality.


An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-21 Reflected Cross-site Scripting via /authenticationendpoint/domain.jsp issue.


Persistent

Cross-Site

Scripting

(XSS)

issues

in

LibreNMS

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

in

the

resource

related

to

and


There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module <= 3.9.2.


Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.


X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.


Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.


Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.


Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.


X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs.


connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.


crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.


ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via \format\ parameter.


The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions up to and including 5.8.1.


A vulnerability in the conferencing component of Mitel ST 14.2 versions GA29 (19.49.9400.0) and earlier could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit could allow an attacker to execute arbitrary scripts.


Cross-site scripting (XSS) vulnerability in Public Knowledge Project (PKP) Open Journal System (OJS) 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter (aka the By Author field).


Cross-site

scripting

(XSS)

vulnerability

in

in

Public

Knowledge

Project

(PKP)

Open

Monograph

Press

(OMP)

through

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

catalog.noTitlesSearch

parameter

(aka

the

Search

field).


Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting.


The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B) does not perform proper validation on user-supplied input and is vulnerable to cross-site scripting attacks. If proper authorization was implemented this vulnerability could be leveraged to perform actions on behalf of another user or the administrator.


An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.


Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious JavaScript code into the website's rendered copy running inside the end user's web browser. It does not allow injecting code into the real (isolated) copy of the website running on the WI Threat Isolation Engine.


** DISPUTED ** Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the \file\ parameter aka an _profiler/open?file= URI. NOTE: The vendor states \The XSS ... is in the web profiler a tool that should never be deployed in production (so we don't handle those issues as security issues).\


There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows a remote attacker to introduce arbitrary JavaScript via manipulation of an unsanitized GET parameter during a forgotPasswordChange.jsp?key= password change.


A cross-site scripting (XSS) vulnerability was found in valeuraddons German Spelling Dictionary v1.3 (an Opera Browser add-on). Instead of providing text for a spelling check remote attackers may inject arbitrary web script or HTML via the ajax query parameter in the URL Address Bar.


A

reflected

Cross-site

scripting

(XSS)

vulnerability

in

Zoho

ManageEngine

Netflow

Analyzer

before

build

Network

Configuration

Manager

before

build

OpManager

before

build

OpUtils

before

build

and

Firewall

Analyzer

before

build

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

'operation'

to


The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web UI is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker with knowledge of the SA web UI hostname or IP address can craft a malicious URL for the SA web UI and target SA web UI users with phishing attacks or other social engineering techniques. A successful attack allows injecting malicious JavaScript code into the SA web UI client application.


A vulnerability has been identified in CP 1604 (All versions) CP 1616 (All versions). The integrated web server of the affected CP devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into following a malicious link. User interaction is required for a successful exploitation. At the time of advisory publication no public exploitation of this vulnerability was known.


A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 5.6.0 to 5.6.7 5.4.0 to 5.4.12 5.2 and below and Fortinet FortiProxy 2.0.0 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.


Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text GIF-Text ICO-Text PNG-Text or JPG-Text.


SAP NetWeaver Enterprise Portal from 7.0 to 7.02 7.11 7.20 7.30 7.31 7.40 7.50 does not sufficiently encode user controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


In Impact and Lineage Analysis in SAP Data Services version 4.2 the management console does not sufficiently validate user-controlled inputs which results in Cross-Site Scripting (XSS) vulnerability.


SAP BusinessObjects Business Intelligence Suite versions 4.10 and 4.20 does not sufficiently encode user controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


SAP NetWeaver Portal WebDynpro Java 7.30 7.31 7.40 7.50 does not sufficiently encode user controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


The SAML 2.0 service provider of SAP Netweaver AS Java Web Application 7.50 does not sufficiently encode user controlled inputs which results in Cross-Site Scripting (XSS) vulnerability.


SAP Business One 9.2 9.3 browser access does not sufficiently encode user controlled inputs which results in a Cross-Site Scripting (XSS) vulnerability.


SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 (Web Intelligence DHTML client) does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


SAP Marketing (UICUAN (1.20 1.30 1.40) SAPSCORE (1.13 1.14)) does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


IBM Jazz Reporting Service (JRS) 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155006.


Cross-Site Scripting in Process Monitoring Infrastructure from 7.10 to 7.11 7.20 7.30 7.31 7.40 7.50 due to inefficient encoding of user controlled inputs.


SAP Solution Manager 7.10 7.20 Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site Scripting.


The logon application of SAP NetWeaver AS Java 7.10 to 7.11 7.20 7.30 7.31 7.40 7.50 does not sufficiently encode user-controlled inputs resulting in a cross-site scripting (XSS) vulnerability.


IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155345.


SAP CRM WebClient UI 7.01 7.31 7.46 7.47 7.48 8.00 8.01 S4FND 1.02 does not sufficiently validate and/or encode hidden fields resulting in Cross-Site Scripting (XSS) vulnerability.


SAP BusinessObjects Financial Consolidation versions 10.0 10.1 does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


In SAP Business Objects Business Intelligence Platform 4.00 4.10 4.20 4.30 the Central Management Console (CMC) does not sufficiently encode user controlled inputs which results in Cross-Site Scripting.


SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks including: cross-site scripting and page hijacking.


SAP BusinessObjects Business Intelligence Platform (BIWorkspace) versions 4.1 and 4.2 does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


SAP Commerce does not sufficiently validate user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the product. Fixed in versions (SAP Hybris Commerce versions 6.2 6.3 6.4 6.5 6.6 6.7).


SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10 7.11 7.20 7.30 7.31 7.40 7.50.


In SAP NetWeaver Application Server for ABAP from 7.0 to 7.02 7.30 7.31 7.40 and from 7.50 to 7.53 applications do not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


A vulnerability in the web-based management interface of Cisco Data Center Analytics Framework could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvh02082.


A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack on an affected system. The vulnerability is due to improper validation of input that is passed to the affected software. An attacker could exploit this vulnerability by persuading a user of the affected software to access a malicious URL. A successful exploit could allow the attacker to access sensitive browser-based information on the affected system or perform arbitrary actions in the affected software in the security context of the user. Cisco Bug IDs: CSCvh49694.


A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated remote attacker to conduct a reflected or Document Object Model based (DOM-based) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve84006.


A vulnerability in the web-based management interface of Cisco WAP150 Wireless-AC/N Dual Radio Access Point with Power over Ethernet (PoE) and WAP361 Wireless-AC/N Dual Radio Wall Plate Access Point with PoE could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve57076.


A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Cisco Bug IDs: CVE-2018-0367.


A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticated remote attacker to conduct a persistent cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvi87326.


A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the web-based management interface to click a link that submits malicious input to the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg74815.


A vulnerability in the web-based management interface of Cisco Small Business 300 Series Managed Switches could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerability exists because the affected management interface performs insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or allow the attacker to access sensitive browser-based information.


A vulnerability in the logs component of Cisco Identity Services Engine could allow an unauthenticated remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of requests stored in logs in the application management interface. An attacker could exploit this vulnerability by sending malicious requests to the targeted system. An exploit could allow the attacker to conduct cross-site scripting attacks when an administrator views the log files. Cisco Bug IDs: CSCvh11308.


A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer (SSL) VPN portal of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of that portal on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the portal or allow the attacker to access sensitive browser-based information. This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco ASA Software: 3000 Series Industrial Security Appliances Adaptive Security Virtual Appliance (ASAv) ASA 5500 Series Adaptive Security Appliances ASA 5500-X Series Next-Generation Firewalls ASA Services Module for Cisco Catalyst 6500 Series Switches ASA Services Module for Cisco 7600 Series Routers. Cisco Bug IDs: CSCvh20742.


A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session possibly tricking a follow-on administrative user to perform administrative actions on the device. Affected releases are Juniper Networks ScreenOS 6.3.0 versions prior to 6.3.0r26.


A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the management interface on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf03514.


Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710.


A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated remote attacker to perform a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the web-based management interface to click a link that is designed to submit malicious input to the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information on the targeted device. Cisco Bug IDs: CSCvg51264.


A vulnerability in the web-based management interface of Cisco Data Center Analytics Framework could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvh02088.


A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22 Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06 Managed Ethernet switch FXC5428 firmware prior to version Ver1.00.07 Power over Ethernet (PoE) switch FXC5210PE/5218PE/5224PE firmware prior to version Ver1.00.14 and Wireless LAN router AE1021/AE1021PE firmware all versions) allows attacker with administrator rights to inject arbitrary web script or HTML via the administrative page.


A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCuy79668.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf69963.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated remote attacker to conduct a Document Object Model (DOM) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf73922.


A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent and malicious scripts. This may allow stealing of information or performing actions as a different user when other users access the Security Director web interface. This issue affects all versions of Juniper Networks Junos Space Security Director prior to 17.2R2.


Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. Cisco Bug IDs: CSCvg70967.


A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface of an affected product. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvh65713.


A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information on the affected system. Cisco Bug IDs: CSCvg45105.


A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and Cisco UCS Director Software could allow an authenticated remote attacker to conduct a Document Object Model-based (DOM-based) stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or allow the attacker to access sensitive browser-based information on the affected device. Cisco Bug IDs: CSCvh12994.


A vulnerability in the web-based management interface of Cisco Prime Network Control System could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.


A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Cisco Bug IDs: CSCvg74126.


A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvk15343.


A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf37392.


Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier EC-CUBE Payment Module (2.11) version 2.3.17 and earlier GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.


A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected system. The vulnerability is due to insufficient validation of user-supplied input of an affected client. An attacker could exploit this vulnerability by executing arbitrary JavaScript in the Jabber client of the recipient. A successful exploit could allow the attacker to execute arbitrary script code in the context of the targeted client or allow the attacker to access sensitive client-based information.


A vulnerability in the WebVPN web-based management interface of Cisco Adaptive Security Appliance could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg33985.


A vulnerability in the web-based management interface of Cisco Videoscape AnyRes Live could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg87525.


A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvi87330.


Cross-site scripting vulnerability in NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier CSDX(P) 4.37210411 and earlier CSDX(D) 3.37210411 and earlier CSDX(S) 2.37210411 and earlier CSDJ-B 01.03.00 and earlier CSDJ-H 01.03.00 and earlier CSDJ-D 01.03.00 and earlier CSDJ-A 03.00.00) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


A reflected cross-site scripting vulnerability in OpenNMS included with Juniper Networks Junos Space may allow the stealing of sensitive information or session credentials from Junos Space administrators or perform administrative actions. This issue affects Juniper Networks Junos Space versions prior to 18.2R1.


A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by placing a malicious string in the Prime Collaboration Provisioning database. A successful exploit could allow the attacker to access Cisco Prime Collaboration Provisioning by injecting crafted data into the database. Cisco Bug IDs: CSCvd86609.


A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web-based interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.


Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. Cisco Bug IDs: CSCvg70904.


A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg86518.


Cross-site scripting vulnerability in QTS 4.2.6 build 20180711 QTS 4.3.3: Qsync Central 3.0.2 QTS 4.3.4: Qsync Central 3.0.3 QTS 4.3.5: Qsync Central 3.0.4 and earlier versions could allow remote attackers to inject Javascript code in the compromised application.


A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected device. The vulnerability is due to improper neutralization of input during web page generation. An attacker could exploit this vulnerability by embedding media in instant messages. An exploit could allow the attacker to cause the recipient chat client to make outbound requests. Cisco Bug IDs: CSCve54001.


A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg81051.


A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a stored Cross-Site Scripting (XSS) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires that the attacker has access to the web interface of an affected device. The attacker must be authenticated as administrative user on the web interface. Afterwards a legitimate user must access the web interface. A successful attack could allow an attacker to execute malicious code in the browser of a legitimate user. At the time of advisory publication no public exploitation of this security vulnerability was known.