CVE-2018-18943

Summary: baserCMS before 4.1.4 is affected by a Cross-Site Scripting (XSS) vulnerability in the Register New Category feature of the Upload menu. The category name can be injected via the data[UploaderCategory][name] parameter to the admin/uploader/uploader_categories/edit URI. Impact/Remediation...

app.ninjaoutreach.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-692772 Description| Value ---|--- Affected Website:| app.ninjaoutreach.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| hidden unti...

boyaca.gov.co XSS vulnerability

Open Bug Bounty ID: OBB-692239 Description| Value ---|--- Affected Website:| boyaca.gov.co Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

aloetech.pl XSS vulnerability

Open Bug Bounty ID: OBB-692235 Description| Value ---|--- Affected Website:| aloetech.pl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...

revistaferroviaria.com.br XSS vulnerability

Open Bug Bounty ID: OBB-692017 Description| Value ---|--- Affected Website:| revistaferroviaria.com.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score...

CVE-2018-18743

An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMSCategories.php?pid=1&lgid=1 URI...

YUNUCMS cross-site scripting vulnerability (CNVD-2018-23275)

YUNUCMS is a three-network, self-substation system of open source content management system. YUNUCMS 1.1.5 in index.php/admin/area/editarea/id/110000 there is a cross-site scripting vulnerability, attackers can exploit the vulnerability to carry out cross-site attacks...

Nextcloud: https://help.nextcloud.com::: Web cache poisoning attack

Hi there, I just found the website: https://help.nextcloud.com is infected with "Web cache poisoning" Abuse this bug, Attacker can: 1. Poison your cache with HTTP header with XSS included. This attack may leads to Stored XSS 2. Poison your website contains malware url cache poisoned by attacker,...

berner-safety.de XSS vulnerability

Open Bug Bounty ID: OBB-691205 Description| Value ---|--- Affected Website:| berner-safety.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Code injection

Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed RSS widget...

Don’t Overlook Qualys Malware Detection

Cyber criminals are constantly looking for opportunities to infect legitimate websites with malware. They can use infected websites to cryptomine, steal data, hijack systems, deface pages, and do other damage to harm a company’s reputation and impact their users. This can result in lost revenue,...

CVE-2018-12669

CVE-2018-12669 affects SV3C L-Series HD Camera devices with versions V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B. A remote authenticated attacker can reset arbitrary user accounts via a request to web/cgi-bin/hi3510/param.cgi. The NVD reports CVSS v3.0 base score 8.8 (HIGH) ...

WordPress plugin tajer arbitrary file upload vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An arbitrary file upload vulnerability exists in the WordPress plugin tajer, which allows attackers to exploit the...

Webshell Bypass Vulnerability in Web Security Dog (IIS Edition) V4.0

Website Security Dog IIS Edition is a server tool that integrates website content security protection, website resource protection and website traffic protection features for comprehensive website security. Webshell bypass vulnerability exists in Web Security Dog IIS Edition V4.0. An attacker can...

OwnTicket 1.0 - TicketID SQL Injection

OwnTicket 1.0 - TicketID SQL Injection Exploit Title: OwnTicket 1.0 - 'TicketID' SQL Injection Dork: N/A Date: 2018-10-18 Exploit Author: Ihsan Sencan Vendor Homepage: https://ownticket.sourceforge.io/ Software Link: https://sourceforge.net/projects/ownticket/files/latest/download Version: 1.0...

It’s Everyone’s Job to Ensure Online Safety at Work

As part of our effort to support National Cyber Security Awareness Month I wanted to provide information on the need for everyone within a business to be aware of their role in keeping the organization safe from cyber attacks. Let’s discuss some of the areas where we see existing organizations...

drmartens.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-686714 Description| Value ---|--- Affected Website:| drmartens.co.kr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

atgreijdanus.nl XSS vulnerability

Open Bug Bounty ID: OBB-686504 Description| Value ---|--- Affected Website:| atgreijdanus.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

S-CMS Hospital Website Builder System has SQL Injection Vulnerability in Frontend

S-CMS hospital station building system is developed by asp+access/mssql, easy to operate, convenient, support PC+mobile+WeChat. There is a SQL injection vulnerability in the frontend of S-CMS Hospital Building System. An attacker can exploit the vulnerability to obtain sensitive information from...

CVE-2018-1534

IBM Rational Publishing Engine 6.0.5 and 6.0.6 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can let an attacker inject arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The issue is tied to the Rational Publishing Engine...