CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (Cross Site Scripting (XSS))

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-9140 XSS 2017-05-22 2017-05-22
0.0
None ??? ??? ??? ??? ??? ???
Cross-site scripting (XSS) vulnerability in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2 CVE-2017-9072 XSS 2017-05-18 2017-05-18
0.0
None ??? ??? ??? ??? ??? ???
Two CalendarXP products have XSS in common parts of HTML files. CalendarXP FlatCalendarXP through 9.9.290 has XSS in iflateng.htm and nflateng.htm. CalendarXP PopCalendarXP through 9.8.308 has XSS in ipopeng.htm and npopeng.htm.
3 CVE-2017-9071 XSS 2017-05-18 2017-05-18
0.0
None ??? ??? ??? ??? ??? ???
In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning.
4 CVE-2017-9070 XSS 2017-05-18 2017-05-18
0.0
None ??? ??? ??? ??? ??? ???
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.
5 CVE-2017-9068 XSS 2017-05-18 2017-05-18
0.0
None ??? ??? ??? ??? ??? ???
In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type parameter.
6 CVE-2017-9063 79 XSS 2017-05-18 2017-05-23
4.3
None Remote Medium Not required None Partial None
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.
7 CVE-2017-9061 79 XSS 2017-05-18 2017-05-23
4.3
None Remote Medium Not required None Partial None
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
8 CVE-2017-8899 264 XSS 2017-05-11 2017-05-16
6.8
None Remote Medium Not required Partial Partial Partial
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The primary cause is the ability to upload an SVG document with a crafted attribute such an onload; however, full path disclosure is required for exploitation.
9 CVE-2017-8898 264 XSS 2017-05-11 2017-05-16
7.5
None Remote Low Not required Partial Partial Partial
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=create request. This is related to the "<> Source" option.
10 CVE-2017-8897 79 XSS 2017-05-11 2017-05-18
4.3
None Remote Medium Not required None Partial None
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision Power Board user who views the announcement.
11 CVE-2017-8892 79 XSS 2017-05-10 2017-05-17
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in OpenText Tempo Box 10.0.3 allows remote attackers to inject arbitrary web script or HTML persistently via the name of an uploaded image.
12 CVE-2017-8876 79 XSS 2017-05-10 2017-05-15
4.3
None Remote Medium Not required None Partial None
Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php.
13 CVE-2017-8833 79 XSS 2017-05-08 2017-05-17
4.3
None Remote Medium Not required None Partial None
Zen Cart 1.6.0 has XSS in the main_page parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of "Download latest in-development version from github."
14 CVE-2017-8832 79 XSS 2017-05-08 2017-05-16
4.3
None Remote Medium Not required None Partial None
Allen Disk 1.6 has XSS in the id parameter to downfile.php.
15 CVE-2017-8801 79 XSS 2017-05-05 2017-05-16
4.3
None Remote Medium Not required None Partial None
Trend Micro OfficeScan 11.0 before SP1 CP 6325 (with Agent Module Build before 6152) and XG before CP 1352 has XSS via a crafted URI using a blocked website.
16 CVE-2017-8795 79 XSS 2017-05-05 2017-05-17
4.3
None Remote Medium Not required None Partial None
An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/smtpg_add.html with the param parameter.
17 CVE-2017-8792 79 XSS 2017-05-05 2017-05-17
4.3
None Remote Medium Not required None Partial None
An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/user_add.html with the param parameter.
18 CVE-2017-8780 79 XSS 2017-05-04 2017-05-12
3.5
None Remote Medium Single system None Partial None
GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element.
19 CVE-2017-8778 79 XSS 2017-05-04 2017-05-15
4.3
None Remote Medium Not required None Partial None
GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.
20 CVE-2017-8763 79 XSS 2017-05-04 2017-05-15
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in modules/Base/Box/check_for_new_version.php in EPESI in Telaxus/EPESI 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URI that lacks the cid parameter.
21 CVE-2017-8762 79 XSS 2017-05-03 2017-05-12
3.5
None Remote Medium Single system None Partial None
GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page, as demonstrated by a crafted oncut attribute in a B element.
22 CVE-2017-8760 79 XSS Bypass 2017-05-05 2017-05-17
4.3
None Remote Medium Not required None Partial None
An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in courier/1000@/index.html with the auth_params parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads, e.g., URL encoding.
23 CVE-2017-8384 79 XSS 2017-05-01 2017-05-11
4.3
None Remote Medium Not required None Partial None
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.
24 CVE-2017-8376 79 XSS 2017-05-01 2017-05-10
3.5
None Remote Medium Single system None Partial None
GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator.
25 CVE-2017-8304 79 XSS 2017-05-05 2017-05-17
4.3
None Remote Medium Not required None Partial None
An issue was discovered on Accellion FTA devices before FTA_9_12_180. courier/1000@/oauth/playground/callback.html allows XSS with a crafted URI.
26 CVE-2017-8302 79 XSS 2017-04-27 2017-05-09
3.5
None Remote Medium Single system None Partial None
Mura CMS 7.0.6967 allows admin/?muraAction= XSS attacks, related to admin/core/views/carch/list.cfm, admin/core/views/carch/loadsiteflat.cfm, admin/core/views/cusers/inc/dsp_nextn.cfm, admin/core/views/cusers/inc/dsp_search_form.cfm, admin/core/views/cusers/inc/dsp_users_list.cfm, admin/core/views/cusers/list.cfm, and admin/core/views/cusers/listusers.cfm.
27 CVE-2017-8298 79 XSS 2017-04-27 2017-05-03
3.5
None Remote Medium Single system None Partial None
cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts > Add New" action, and during creation of new tags and users.
28 CVE-2017-8103 79 XSS 2017-04-24 2017-04-27
4.3
None Remote Medium Not required None Partial None
In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event.
29 CVE-2017-8102 79 XSS 2017-04-24 2017-04-28
3.5
None Remote Medium Single system None Partial None
Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin.
30 CVE-2017-8085 79 XSS 2017-04-24 2017-04-28
4.3
None Remote Medium Not required None Partial None
In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.
31 CVE-2017-8052 79 XSS 2017-04-21 2017-04-26
4.3
None Remote Medium Not required None Partial None
Craft CMS before 2.6.2974 allows XSS attacks.
32 CVE-2017-7992 79 XSS 2017-04-21 2017-04-27
4.3
None Remote Medium Not required None Partial None
Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter.
33 CVE-2017-7990 352 XSS CSRF 2017-04-20 2017-04-26
6.8
None Remote Medium Not required Partial Partial Partial
The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp.
34 CVE-2017-7987 79 XSS 2017-04-25 2017-05-03
4.3
None Remote Medium Not required None Partial None
In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate escaping of file and folder names leads to XSS vulnerabilities in the template manager component.
35 CVE-2017-7986 79 XSS 2017-04-25 2017-05-02
4.3
None Remote Medium Not required None Partial None
In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components.
36 CVE-2017-7985 79 XSS 2017-04-25 2017-05-03
4.3
None Remote Medium Not required None Partial None
In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components.
37 CVE-2017-7984 79 XSS 2017-04-25 2017-05-02
4.3
None Remote Medium Not required None Partial None
In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering leads to XSS in the template manager component.
38 CVE-2017-7953 79 XSS 2017-05-16 2017-05-24
3.5
None Remote Medium Single system None Partial None
INFOR EAM V11.0 Build 201410 has XSS via comment fields.
39 CVE-2017-7944 79 XSS 2017-04-24 2017-04-27
4.3
None Remote Medium Not required None Partial None
XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in page_dbsettings.php.
40 CVE-2017-7897 79 XSS 2017-04-18 2017-04-25
4.3
None Remote Medium Not required None Partial None
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
41 CVE-2017-7896 79 XSS 2017-04-18 2017-04-24
4.3
None Remote Medium Not required None Partial None
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS.
42 CVE-2017-7891 79 XSS 2017-04-17 2017-04-25
4.3
None Remote Medium Not required None Partial None
sourcebans-pp (SourceBans++) 1.5.4.7 has XSS in admin.comms.php via the rebanid parameter.
43 CVE-2017-7887 79 XSS 2017-05-10 2017-05-15
4.3
None Remote Medium Not required None Partial None
Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter.
44 CVE-2017-7871 79 XSS 2017-04-14 2017-04-24
4.3
None Remote Medium Not required None Partial None
trollepierre/tdm before 2017-04-13 is vulnerable to a reflected XSS in tdm-master/webhook.php (challenge parameter).
45 CVE-2017-7725 79 XSS 2017-04-13 2017-04-20
4.3
None Remote Medium Not required None Partial None
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector.
46 CVE-2017-7723 79 XSS 2017-04-24 2017-04-28
4.3
None Remote Medium Not required None Partial None
XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.
47 CVE-2017-7626 79 XSS 2017-04-12 2017-04-20
4.3
None Remote Medium Not required None Partial None
The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php (n_art,type in GET Method).
48 CVE-2017-7621 79 XSS 2017-04-11 2017-04-17
4.3
None Remote Medium Not required None Partial None
Cross Site Scripting Vulnerability in core-eMLi in AuroMeera Technometrix Pvt. Ltd. eMLi V1.0 allows an Attacker to send malicious code, generally in the form of a browser-side script, to a different end user via the page parameter to code/student_portal/home.php. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0.
49 CVE-2017-7591 79 XSS 2017-04-08 2017-04-13
4.3
None Remote Medium Not required None Partial None
OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by the _sortKeys parameter to the authzRoles script under managed/user/.
50 CVE-2017-7590 79 XSS 2017-04-08 2017-04-28
4.3
None Remote Medium Not required None Partial None
OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by a crafted Managed Object Name.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.