Search
Total
20468 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2009-1310 | 1 Mozilla | 1 Firefox | 2018-10-03 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in the MozSearch plugin implementation in Mozilla Firefox before 3.0.9 allows user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SearchForm element. | |||||
| CVE-2009-1308 | 1 Mozilla | 3 Firefox, Seamonkey, Thunderbird | 2018-10-03 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey allows remote attackers to inject arbitrary web script or HTML via vectors involving XBL JavaScript bindings and remote stylesheets, as exploited in the wild by a March 2009 eBay listing. | |||||
| CVE-2009-0312 | 1 Moinmoin | 1 Moinmoin | 2018-10-03 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content. | |||||
| CVE-2008-3422 | 2 Mono, Mono Project | 2 Mono, Mono | 2018-10-03 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs (RenderAttributes), (3) HtmlInputButton (RenderAttributes), (4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect (RenderChildren). | |||||
| CVE-2008-0416 | 1 Mozilla | 3 Firefox, Seamonkey, Thunderbird | 2018-10-03 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allow remote attackers to inject arbitrary web script or HTML via certain character encodings, including (1) a backspace character that is treated as whitespace, (2) 0x80 with Shift_JIS encoding, and (3) "zero-length non-ASCII sequences" in certain Asian character sets. | |||||
| CVE-2008-1098 | 1 Moinmoin | 1 Moinmoin | 2018-10-03 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) certain input processed by formatter/text_gedit.py (aka the gui editor formatter); (2) a page name, which triggers an injection in PageEditor.py when the page is successfully deleted by a victim in a DeletePage action; or (3) the destination page name for a RenamePage action, which triggers an injection in PageEditor.py when a victim's rename attempt fails because of a duplicate name. NOTE: the AttachFile XSS issue is already covered by CVE-2008-0781, and the login XSS issue is already covered by CVE-2008-0780. | |||||
| CVE-2008-0780 | 1 Moinmoin | 1 Moinmoin | 2018-10-03 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in MoinMoin 1.5.x through 1.5.8 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the login action. | |||||
| CVE-2008-0781 | 1 Moinmoin | 1 Moinmoin | 2018-10-03 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) message, (2) pagename, and (3) target filenames. | |||||
| CVE-2018-1155 | 1 Tenable | 1 Securitycenter | 2018-10-03 | 3.5 LOW | 5.4 MEDIUM |
| In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue. | |||||
| CVE-2018-12606 | 1 Gitlab | 1 Gitlab | 2018-10-03 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature. | |||||
| CVE-2018-12607 | 1 Gitlab | 1 Gitlab | 2018-10-03 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding. | |||||
| CVE-2018-12605 | 1 Gitlab | 1 Gitlab | 2018-10-03 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'url_for' contained a XSS issue due to it allowing arbitrary protocols as a parameter. | |||||
| CVE-2018-14977 | 1 Q-cms | 1 Qcms | 2018-10-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different vulnerability than CVE-2018-8070. | |||||
| CVE-2018-14976 | 1 Q-cms | 1 Qcms | 2018-10-03 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS. | |||||
| CVE-2018-14975 | 1 Q-cms | 1 Qcms | 2018-10-03 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS. | |||||
| CVE-2018-14974 | 1 Q-cms | 1 Qcms | 2018-10-03 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/news.php has XSS. | |||||
| CVE-2018-14973 | 1 Q-cms | 1 Qcms | 2018-10-03 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS. | |||||
| CVE-2018-14972 | 1 Q-cms | 1 Qcms | 2018-10-03 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS. | |||||
| CVE-2018-14970 | 1 Q-cms | 1 Qcms | 2018-10-03 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS. | |||||
| CVE-2018-14971 | 1 Q-cms | 1 Qcms | 2018-10-03 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS. | |||||
| CVE-2018-14969 | 1 Q-cms | 1 Qcms | 2018-10-03 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS. | |||||
| CVE-2018-14504 | 1 Mantisbt | 1 Mantisbt | 2018-10-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar" onclick="alert(1)'). | |||||
| CVE-2018-14777 | 1 Dleviet | 1 Datalife Engine | 2018-10-02 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in DataLife Engine (DLE) through 13.0. An attacker can use XSS (related to the /addnews.html and /index.php?do=addnews URIs) to send a malicious script to unsuspecting Admins or users. | |||||
| CVE-2018-0614 | 1 Necplatforms | 16 Calsos Csdj-a, Calsos Csdj-a Firmware, Calsos Csdj-b and 13 more | 2018-10-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting vulnerability in NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlier, CSDX(S) 2.37210411 and earlier, CSDJ-B 01.03.00 and earlier, CSDJ-H 01.03.00 and earlier, CSDJ-D 01.03.00 and earlier, CSDJ-A 03.00.00) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2018-14929 | 1 Matera | 1 Banco | 2018-10-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp (aka home page) url parameter. | |||||
| CVE-2018-14924 | 1 Matera | 1 Banco | 2018-10-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" (aka user fullname) field. | |||||
| CVE-2018-1999029 | 1 Jenkins | 1 Shelve Project | 2018-10-01 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions. | |||||
| CVE-2018-12944 | 1 Seeddms | 1 Seeddms | 2018-09-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the name field. | |||||
| CVE-2018-14835 | 1 Subrion | 1 Subrion Cms | 2018-09-28 | 3.5 LOW | 5.4 MEDIUM |
| Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas. | |||||
| CVE-2018-14838 | 1 Rejucms Project | 1 Rejucms | 2018-09-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| rejucms 2.1 has stored XSS via the admin/book.php content parameter. | |||||
| CVE-2018-14686 | 1 Xycms Project | 1 Xycms | 2018-09-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| system/edit_book.php in XYCMS 1.7 has stored XSS via a crafted add_do.php request, related to add_book.php. | |||||
| CVE-2018-7649 | 1 Fibranet | 1 Monitorix | 2018-09-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Monitorix before 3.10.1 allows XSS via CGI variables. | |||||
| CVE-2018-14497 | 1 Tendacn | 2 D152, D152 Firmware | 2018-09-28 | 3.5 LOW | 5.4 MEDIUM |
| Tenda D152 ADSL routers allow XSS via a crafted SSID. | |||||
| CVE-2016-1592 | 1 Netiq | 1 Identity Manager | 2018-09-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.do CGI. | |||||
| CVE-2015-0787 | 1 Netiq | 1 Identity Manager | 2018-09-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI. | |||||
| CVE-2018-14776 | 1 Clickstudios | 1 Passwordstate | 2018-09-27 | 3.5 LOW | 5.4 MEDIUM |
| Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document. | |||||
| CVE-2018-14541 | 1 Readymadeb2bscript | 1 Basic B2b | 2018-09-27 | 3.5 LOW | 5.4 MEDIUM |
| PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields. | |||||
| CVE-2017-6213 | 1 Paypal | 1 Php Invoice Sdk | 2018-09-27 | 3.5 LOW | 5.4 MEDIUM |
| paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution. | |||||
| CVE-2017-6215 | 1 Paypal | 1 Php Permissions Sdk | 2018-09-27 | 3.5 LOW | 5.4 MEDIUM |
| paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code execution. | |||||
| CVE-2018-14873 | 1 Rincewind Project | 1 Rincewind | 2018-09-27 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in Rincewind 0.1. There is a cross-site scripting (XSS) vulnerability involving a p=account request to index.php and another file named commonPages.php. | |||||
| CVE-2018-14904 | 1 Samsung | 1 Syncthru Web Service | 2018-09-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| Samsung Syncthru Web Service V4.05.61 is vulnerable to Multiple unauthenticated XSS attacks on several parameters, as demonstrated by ruiFw_pid. | |||||
| CVE-2018-14877 | 1 Weaselcms Project | 1 Weaselcms | 2018-09-27 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in WeaselCMS v0.3.5. XSS exists via Site Language, Site Title, Site Description, and Site Keywords on the SETTINGS page. | |||||
| CVE-2018-14936 | 1 Mylittleforum | 1 My Little Forum | 2018-09-27 | 3.5 LOW | 4.8 MEDIUM |
| The Add page option in my little forum 2.4.12 allows XSS via the Title field. | |||||
| CVE-2018-14937 | 1 Mylittleforum | 1 My Little Forum | 2018-09-27 | 3.5 LOW | 4.8 MEDIUM |
| The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field. | |||||
| CVE-2018-14906 | 1 3cx | 1 3cx Web Server | 2018-09-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters. | |||||
| CVE-2018-14905 | 1 3cx | 1 3cx Web Server | 2018-09-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter. | |||||
| CVE-2018-16772 | 1 Hoosk | 1 Hoosk | 2018-09-24 | 3.5 LOW | 4.8 MEDIUM |
| Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new. | |||||
| CVE-2018-16773 | 1 Easycms | 1 Easycms | 2018-09-24 | 3.5 LOW | 4.8 MEDIUM |
| EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field. | |||||
| CVE-2018-14493 | 1 Opmantek | 1 Open-audit | 2018-09-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name. | |||||
| CVE-2018-0655 | 1 Weseek | 1 Growi | 2018-09-21 | 3.5 LOW | 4.8 MEDIUM |
| Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page. | |||||