CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-79

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-8103 79 XSS 2017-04-24 2017-04-27
4.3
None Remote Medium Not required None Partial None
In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event.
2 CVE-2017-8102 79 XSS 2017-04-24 2017-04-28
3.5
None Remote Medium Single system None Partial None
Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin.
3 CVE-2017-8085 79 XSS 2017-04-24 2017-04-28
4.3
None Remote Medium Not required None Partial None
In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.
4 CVE-2017-8052 79 XSS 2017-04-21 2017-04-26
4.3
None Remote Medium Not required None Partial None
Craft CMS before 2.6.2974 allows XSS attacks.
5 CVE-2017-7992 79 XSS 2017-04-21 2017-04-27
4.3
None Remote Medium Not required None Partial None
Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter.
6 CVE-2017-7944 79 XSS 2017-04-24 2017-04-27
4.3
None Remote Medium Not required None Partial None
XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in page_dbsettings.php.
7 CVE-2017-7897 79 XSS 2017-04-18 2017-04-25
4.3
None Remote Medium Not required None Partial None
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
8 CVE-2017-7896 79 XSS 2017-04-18 2017-04-24
4.3
None Remote Medium Not required None Partial None
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS.
9 CVE-2017-7891 79 XSS 2017-04-17 2017-04-25
4.3
None Remote Medium Not required None Partial None
sourcebans-pp (SourceBans++) 1.5.4.7 has XSS in admin.comms.php via the rebanid parameter.
10 CVE-2017-7871 79 XSS 2017-04-14 2017-04-24
4.3
None Remote Medium Not required None Partial None
trollepierre/tdm before 2017-04-13 is vulnerable to a reflected XSS in tdm-master/webhook.php (challenge parameter).
11 CVE-2017-7725 79 XSS 2017-04-13 2017-04-20
4.3
None Remote Medium Not required None Partial None
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector.
12 CVE-2017-7723 79 XSS 2017-04-24 2017-04-28
4.3
None Remote Medium Not required None Partial None
XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.
13 CVE-2017-7626 79 XSS 2017-04-12 2017-04-20
4.3
None Remote Medium Not required None Partial None
The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php (n_art,type in GET Method).
14 CVE-2017-7621 79 XSS 2017-04-11 2017-04-17
4.3
None Remote Medium Not required None Partial None
Cross Site Scripting Vulnerability in core-eMLi in AuroMeera Technometrix Pvt. Ltd. eMLi V1.0 allows an Attacker to send malicious code, generally in the form of a browser-side script, to a different end user via the page parameter to code/student_portal/home.php. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0.
15 CVE-2017-7591 79 XSS 2017-04-08 2017-04-13
4.3
None Remote Medium Not required None Partial None
OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by the _sortKeys parameter to the authzRoles script under managed/user/.
16 CVE-2017-7590 79 XSS 2017-04-08 2017-04-28
4.3
None Remote Medium Not required None Partial None
OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by a crafted Managed Object Name.
17 CVE-2017-7583 79 XSS 2017-04-07 2017-04-12
4.3
None Remote Medium Not required None Partial None
ILIAS before 5.2.3 has XSS via SVG documents.
18 CVE-2017-7579 79 XSS 2017-04-07 2017-04-12
4.3
None Remote Medium Not required None Partial None
inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field.
19 CVE-2017-7409 79 XSS 2017-04-20 2017-04-26
4.3
None Remote Medium Not required None Partial None
Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 and PAN-70674.
20 CVE-2017-7400 79 XSS 2017-04-03 2017-04-11
3.5
None Remote Medium Single system None Partial None
OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.
21 CVE-2017-7391 79 Exec Code XSS 2017-03-31 2017-04-04
4.3
None Remote Medium Not required None Partial None
A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
22 CVE-2017-7390 79 Exec Code XSS 2017-03-31 2017-04-04
4.3
None Remote Medium Not required None Partial None
A Cross-Site Scripting (XSS) was discovered in 'SocialNetwork v1.2.1'. The vulnerability exists due to insufficient filtration of user-supplied data (mail) passed to the 'SocialNetwork-andrea/app/template/pw_forgot.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
23 CVE-2017-7389 79 Exec Code XSS 2017-03-31 2017-04-05
4.3
None Remote Medium Not required None Partial None
Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'. The vulnerabilities exist due to insufficient filtration of user-supplied data (meeting_id, user) passed to the 'openeclass-master/modules/tc/webconf/webconf.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
24 CVE-2017-7388 79 Exec Code XSS 2017-03-31 2017-04-05
4.3
None Remote Medium Not required None Partial None
A Cross-Site Scripting (XSS) was discovered in 'wallacepos v1.4.1'. The vulnerability exists due to insufficient filtration of user-supplied data (token) passed to the 'wallacepos-master/myaccount/resetpassword.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
25 CVE-2017-7387 79 XSS 2017-03-31 2017-04-05
4.3
None Remote Medium Not required None Partial None
TheFirstQuestion/HelpMeWatchWho before 2017-03-28 is vulnerable to a reflected XSS in HelpMeWatchWho-master/unaired.php (episodeID parameter).
26 CVE-2017-7386 79 XSS 2017-03-31 2017-04-04
4.3
None Remote Medium Not required None Partial None
citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php (model parameter).
27 CVE-2017-7363 79 XSS 2017-03-31 2017-04-04
4.3
None Remote Medium Not required None Partial None
Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack.
28 CVE-2017-7362 79 XSS 2017-03-31 2017-04-04
4.3
None Remote Medium Not required None Partial None
Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.
29 CVE-2017-7361 79 XSS 2017-03-31 2017-04-04
4.3
None Remote Medium Not required None Partial None
Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack.
30 CVE-2017-7360 79 XSS 2017-03-31 2017-04-04
4.3
None Remote Medium Not required None Partial None
Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack.
31 CVE-2017-7359 79 XSS 2017-03-31 2017-04-04
4.3
None Remote Medium Not required None Partial None
Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack.
32 CVE-2017-7320 79 DoS XSS Http R.Spl. 2017-03-30 2017-03-31
4.3
None Remote Medium Not required None Partial None
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value.
33 CVE-2017-7309 79 XSS 2017-03-31 2017-04-04
3.5
None Remote Medium Single system None Partial None
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.
34 CVE-2017-7298 79 XSS 2017-03-29 2017-03-30
3.5
None Remote Medium Single system None Partial None
In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element.
35 CVE-2017-7271 79 XSS 2017-03-27 2017-03-30
4.3
None Remote Medium Not required None Partial None
Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
36 CVE-2017-7257 79 XSS 2017-03-24 2017-03-30
3.5
None Remote Medium Single system None Partial None
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack.
37 CVE-2017-7256 79 XSS 2017-03-24 2017-03-30
3.5
None Remote Medium Single system None Partial None
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack.
38 CVE-2017-7255 79 XSS 2017-03-24 2017-04-04
3.5
None Remote Medium Single system None Partial None
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack.
39 CVE-2017-7251 79 Exec Code XSS 2017-03-23 2017-03-28
4.3
None Remote Medium Not required None Partial None
A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) passed to the "pi-develop/www/script/editor/markitup/preview/markdown.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
40 CVE-2017-7250 79 Exec Code XSS 2017-03-23 2017-03-28
4.3
None Remote Medium Not required None Partial None
A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (action) passed to the 'Gazelle-master/sections/tools/finances/bitcoin_balance.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
41 CVE-2017-7249 79 Exec Code XSS 2017-03-23 2017-03-28
4.3
None Remote Medium Not required None Partial None
Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data (action, userid) passed to the 'Gazelle-master/sections/tools/data/ocelot_info.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
42 CVE-2017-7248 79 Exec Code XSS 2017-03-23 2017-03-28
4.3
None Remote Medium Not required None Partial None
A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (type) passed to the 'Gazelle-master/sections/better/transcode.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
43 CVE-2017-7247 79 Exec Code XSS 2017-03-23 2017-03-28
4.3
None Remote Medium Not required None Partial None
Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data (torrents, size) passed to the 'Gazelle-master/sections/tools/managers/multiple_freeleech.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
44 CVE-2017-7242 79 XSS 2017-03-23 2017-03-28
4.3
None Remote Medium Not required None Partial None
Multiple Cross-Site Scripting (XSS) were discovered in admin/modules components in SLiMS 7 Cendana through 2017-03-23: the keywords parameter to bibliography/checkout_item.php, bibliography/dl_print.php, bibliography/item.php, bibliography/item_barcode_generator.php, bibliography/printed_card.php, circulation/loan_rules.php, master_file/author.php, master_file/coll_type.php, and master_file/doc_language.php and the quickReturnID field to circulation/ajax_action.php.
45 CVE-2017-7241 79 XSS 2017-03-31 2017-04-04
3.5
None Remote Medium Single system None Partial None
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.
46 CVE-2017-7222 79 XSS 2017-03-22 2017-03-23
4.3
None Remote Medium Not required None Partial None
A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'window_title' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (config_inc.php).
47 CVE-2017-7215 79 XSS 2017-03-21 2017-04-07
4.3
None Remote Medium Not required None Partial None
Cross site scripting in some view elements in the index filter tool in app/webroot/js/misp2.4.68.js and the organisation landing page in app/View/Organisations/ajax/landingpage.ctp of MISP before 2.4.69 allows remote attackers to inject arbitrary web script or HTML.
48 CVE-2017-7205 79 Exec Code XSS 2017-03-21 2017-03-23
4.3
None Remote Medium Not required None Partial None
A Cross-Site Scripting (XSS) was discovered in GamePanelX-V3 3.0.12. The vulnerability exists due to insufficient filtration of user-supplied data (a) passed to the "GamePanelX-V3-master/ajax/ajax.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
49 CVE-2017-7204 79 Exec Code XSS 2017-03-21 2017-03-23
4.3
None Remote Medium Not required None Partial None
A Cross-Site Scripting (XSS) was discovered in imdbphp 5.1.1. The vulnerability exists due to insufficient filtration of user-supplied data (name) passed to the "imdbphp-master/demo/search.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
50 CVE-2017-7203 79 Exec Code XSS 2017-03-21 2017-03-23
4.3
None Remote Medium Not required None Partial None
A Cross-Site Scripting (XSS) was discovered in ZoneMinder 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data (postLoginQuery) passed to the "ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.