Filtered by CWE-79
Filtered by vendor Subscriptions
Total 40541 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-11074 2 Emc, Rsa 2 Rsa Authentication Manager, Authentication Manager 2024-11-21 N/A
RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to the browser DOM, which code is then executed by the web browser in the context of the vulnerable web application.
CVE-2018-11073 2 Emc, Rsa 2 Rsa Authentication Manager, Authentication Manager 2024-11-21 N/A
RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicious Operations Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser.
CVE-2018-11059 1 Rsa 1 Archer 2024-11-21 N/A
RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When application users access the corrupted data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.
CVE-2018-11040 3 Debian, Oracle, Vmware 28 Debian Linux, Agile Product Lifecycle Management, Application Testing Suite and 25 more 2024-11-21 7.5 High
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
CVE-2018-11027 1 Ruckussecurity 2 Icx7450-48, Icx7450-48 Firmware 2024-11-21 N/A
A reflected XSS vulnerability on Ruckus ICX7450-48 devices allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-11012 1 Halo 1 Halo 2024-11-21 N/A
ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.
CVE-2018-11011 1 Halo 1 Halo 2024-11-21 N/A
ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.
CVE-2018-10994 1 Signal 1 Signal-desktop 2024-11-21 N/A
js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.
CVE-2018-10948 1 Synacor 1 Zimbra Collaboration Suite 2024-11-21 N/A
Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
CVE-2018-10939 2 Synacor, Zimbra 2 Zimbra Collaboration Suite, Zimbra Collaboration Suite 2024-11-21 N/A
Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.
CVE-2018-10937 1 Redhat 1 Openshift Container Platform 2024-11-21 N/A
A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to create pods can use this flaw to perform actions on the K8s API as the victim.
CVE-2018-10934 1 Redhat 4 Enterprise Linux Server, Jboss Enterprise Application Platform, Jboss Single Sign On and 1 more 2024-11-21 N/A
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.
CVE-2018-10854 2 Linux, Redhat 3 Linux Kernel, Cloudforms Management Engine, Cloudforms Managementengine 2024-11-21 5.4 Medium
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.
CVE-2018-10821 1 Blackcat-cms 1 Blackcat Cms 2024-11-21 4.8 Medium
Cross-site scripting (XSS) vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel.
CVE-2018-10817 1 Severalnines 1 Clustercontrol 2024-11-21 N/A
Severalnines ClusterControl before 1.6.0-4699 allows XSS.
CVE-2018-10810 1 Livezilla 1 Livezilla 2024-11-21 N/A
chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Accept-Language HTTP header.
CVE-2018-10806 1 Frogcms Project 1 Frogcms 2024-11-21 N/A
An issue was discovered in Frog CMS 0.9.5. There is a reflected Cross Site Scripting Vulnerability via the file[current_name] parameter to the admin/?/plugin/file_manager/rename URI. This can be used in conjunction with CSRF.
CVE-2018-10803 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF.
CVE-2018-10763 1 Synametrics 1 Synaman 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page.
CVE-2018-10752 1 Tagregator Project 1 Tagregator 2024-11-21 N/A
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.