2019

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerabilit

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerabilit

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerabilit

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerabilit

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerabilit

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demo

CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (a

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cro

In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential m

SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML int

The Postmatic plugin before 1.4.6 for WordPress has XSS.

The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.

The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?

The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.

The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.

The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_p

The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.

The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page

An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger re

An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac para

Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the mali

kkcms 1.3 has jx.php?url= XSS.

A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any s

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them

Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think

Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid vu

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se

SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send b

IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim.

Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL p

JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.

JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox brow

JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.

JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality

Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by po

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Moja

IBM Security Directory Server 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi

A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an unauthenticated, re

A vulnerability in the Clientless SSL VPN (WebVPN) portal of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower

A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthentica

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remo

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remo

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Mana

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Mana

An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The is

A vulnerability in Cisco Unified Contact Center Express (UCCX) Software could allow an unauthenticated, remote attacker