CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 3 and 3.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
701 CVE-2017-1002011 79 XSS 2017-09-14 2017-09-20
3.5
None Remote Medium Single system None Partial None
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_description where anyone with privileges to modify or add galleries/images and inject javascript into the database.
702 CVE-2017-1001001 79 XSS 2017-11-01 2017-11-18
3.5
None Remote Medium Single system None Partial None
PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges.
703 CVE-2017-1000510 79 Exec Code XSS 2018-02-09 2018-02-26
3.5
None Remote Medium Single system None Partial None
Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code.
704 CVE-2017-1000509 79 Exec Code XSS 2018-02-09 2018-02-26
3.5
None Remote Medium Single system None Partial None
Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code.
705 CVE-2017-1000507 79 DoS Exec Code XSS 2018-02-09 2018-02-26
3.5
None Remote Medium Single system None Partial None
Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and execution of javascript code.
706 CVE-2017-1000495 79 DoS XSS 2018-01-03 2018-01-17
3.5
None Remote Medium Single system None Partial None
QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthorised actions with an administrator user's account
707 CVE-2017-1000482 79 XSS 2018-01-03 2018-01-17
3.5
None Remote Medium Single system None Partial None
A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.
708 CVE-2017-1000478 79 DoS XSS 2018-01-03 2018-01-17
3.5
None Remote Medium Single system None Partial None
ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service.
709 CVE-2017-1000467 79 Exec Code XSS 2018-01-03 2018-01-17
3.5
None Remote Medium Single system None Partial None
LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code.
710 CVE-2017-1000466 79 Exec Code XSS 2018-01-02 2018-01-16
3.5
None Remote Medium Single system None Partial None
Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code.
711 CVE-2017-1000465 79 Exec Code XSS 2018-01-09 2018-02-01
3.5
None Remote Medium Single system None Partial None
Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within the page creation page, which can result in disruption of service and execution of javascript code.
712 CVE-2017-1000463 79 Exec Code XSS 2018-01-02 2018-01-17
3.5
None Remote Medium Single system None Partial None
Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in disruption of service and execution of javascript code.
713 CVE-2017-1000462 79 Exec Code XSS 2018-01-03 2018-01-17
3.5
None Remote Medium Single system None Partial None
BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code.
714 CVE-2017-1000457 79 XSS 2018-01-02 2018-01-17
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the "Administrators" or "Content Administrators" role.
715 CVE-2017-1000442 79 XSS 2018-01-02 2018-01-16
3.5
None Remote Medium Single system None Partial None
Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace
716 CVE-2017-1000392 79 XSS 2018-01-25 2018-02-08
3.5
None Remote Medium Single system None Partial None
Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.
717 CVE-2017-1000386 79 XSS 2018-01-25 2018-02-15
3.5
None Remote Medium Single system None Partial None
Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. This could include, for example, arbitrary JavaScript. Active Choices now sanitizes the HTML inserted on the 'Build With Parameters' page if and only if the script is executed in a sandbox. As unsandboxed scripts are subject to administrator approval, it is up to the administrator to allow or disallow problematic script output.
718 CVE-2017-1000250 200 +Info 2017-09-12 2018-02-16
3.3
None Local Network Low Not required Partial None None
All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.
719 CVE-2017-1000240 79 XSS 2017-11-16 2017-11-30
3.5
None Remote Medium Single system None Partial None
The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting (XSS) vulnerabilities affecting version 5.0.0 and prior versions. These vulnerabilities could allow remote authenticated attackers to inject arbitrary web script or HTML.
720 CVE-2017-1000239 79 XSS 2017-11-16 2017-11-29
3.5
None Remote Medium Single system None Partial None
InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site.
721 CVE-2017-1000227 79 XSS 2017-11-17 2017-12-03
3.5
None Remote Medium Single system None Partial None
Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin can
722 CVE-2017-1000223 79 XSS 2017-11-17 2017-12-01
3.5
None Remote Medium Single system None Partial None
A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.
723 CVE-2017-1000213 79 XSS 2017-11-16 2017-11-29
3.5
None Remote Medium Single system None Partial None
WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=user_search
724 CVE-2017-1000164 79 Exec Code XSS 2017-11-17 2017-11-29
3.5
None Remote Medium Single system None Partial None
Tine 2.0 version 2017.02.4 is vulnerable to XSS in the Addressbook resulting code execution and privilege escalation
725 CVE-2017-1000160 79 XSS 2017-11-17 2017-12-01
3.5
None Remote Medium Single system None Partial None
EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection
726 CVE-2017-1000157 200 +Info 2017-11-03 2017-11-13
3.5
None Remote Medium Single system Partial None None
Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain text passwords in the event_log table during the user creation process if full event logging was turned on.
727 CVE-2017-1000149 79 XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.10 before 1.10.9 and 15.04 before 15.04.6 and 15.10 before 15.10.2 are vulnerable to XSS due to window.opener (target="_blank" and window.open())
728 CVE-2017-1000146 79 XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to the arbitrary execution of Javascript in the browser of a logged-in user because the title of the portfolio page was not being properly escaped in the AJAX script that updates the Add/remove watchlist link on artefact detail pages.
729 CVE-2017-1000144 79 XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.9 before 1.9.6 and 1.10 before 1.10.4 and 15.04 before 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javascript into an institution display name, which will be displayed to other users unescaped on some Mahara system pages.
730 CVE-2017-1000140 79 Exec Code XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .xml file that can have its code executed when user tries to download the file.
731 CVE-2017-1000138 79 XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when dragging/dropping files into a collection if the file has Javascript code in its title.
732 CVE-2017-1000137 79 XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when adding a text block to a page via the keyboard (rather than drag and drop).
733 CVE-2017-1000132 79 Exec Code XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .swf files that can have its code executed when a user tries to download the file.
734 CVE-2017-1000103 79 XSS 2017-10-04 2017-11-01
3.5
None Remote Medium Single system None Partial None
The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view.
735 CVE-2017-1000102 79 XSS 2017-10-04 2017-11-01
3.5
None Remote Medium Single system None Partial None
The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to these plugins, for example the console output which is parsed to extract build warnings (Warnings Plugin), could insert arbitrary HTML into this view.
736 CVE-2017-1000088 79 XSS 2017-10-04 2017-11-02
3.5
None Remote Medium Single system None Partial None
The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects. There was no input validation, which meant users were able to use javascript: schemes for these links.
737 CVE-2017-18286 79 XSS 2018-06-05 2018-07-31
3.5
None Remote Medium Single system None Partial None
nZEDb v0.7.3.3 has XSS in the 404 error page.
738 CVE-2017-18285 264 2018-06-04 2018-10-21
3.6
None Local Low Not required Partial Partial None
The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change.
739 CVE-2017-18284 264 2018-06-04 2018-10-21
3.6
None Local Low Not required None Partial Partial
The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL.
740 CVE-2017-18270 255 DoS 2018-05-18 2018-08-24
3.6
None Local Low Not required None Partial Partial
In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands, setting unwanted defaults or causing a denial of service.
741 CVE-2017-18259 79 XSS 2018-04-10 2018-05-16
3.5
None Remote Medium Single system None Partial None
Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.
742 CVE-2017-18248 20 2018-03-26 2018-07-12
3.5
None Remote Medium Single system None None Partial
The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.
743 CVE-2017-18228 79 XSS 2018-03-12 2018-04-09
3.5
None Remote Medium Single system None Partial None
Remedy Mid Tier in BMC Remedy AR System 9.1 allows XSS via the ATTKey parameter in an arsys/servlet/AttachServlet request.
744 CVE-2017-18177 79 XSS 2018-02-12 2018-03-05
3.5
None Remote Medium Single system None Partial None
Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1.
745 CVE-2017-18176 79 XSS 2018-02-12 2018-03-05
3.5
None Remote Medium Single system None Partial None
Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in 10.1.
746 CVE-2017-18175 79 XSS 2018-02-12 2018-03-05
3.5
None Remote Medium Single system None Partial None
Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src attribute of an IMG element. This is fixed in 10.1.
747 CVE-2017-18102 79 XSS 2018-04-17 2018-05-21
3.5
None Remote Medium Single system None Partial None
The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in nested wiki markup.
748 CVE-2017-18097 79 XSS 2018-04-06 2018-05-09
3.5
None Remote Medium Single system None Partial None
The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the title of a Trello card.
749 CVE-2017-18094 79 XSS 2018-03-22 2018-04-17
3.5
None Remote Medium Single system None Partial None
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.
750 CVE-2017-18093 79 XSS 2018-02-19 2018-03-12
3.5
None Remote Medium Single system None Partial None
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.
Total number of vulnerabilities : 3652   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 (This Page)16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.