QNAP QTS XSS Vulnerability (NAS-201911-26)

QNAP QTS is prone to a stored cross-site scripting vulnerability in QTS Event Notification. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-43414)

FusionPBX is an open source enterprise IPPBX interface management system based on FreeSWITHC. A cross-site scripting vulnerability exists in app/fifolist/fifointeractive.php in FusionPBX 4.4.1. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML via the c...

CVE-2019-19385

CVE-2019-19385 describes a cross-site scripting (XSS) vulnerability in FusionPBX 4.4.1, specifically in the file app/dialplans/dialplans.php. The issue allows remote attackers to inject arbitrary web script or HTML via the app_uuid parameter. The connected sources confirm the affected product/ver...

CVE-2019-19387

FusionPBX 4.4.1 is affected by a cross-site scripting (XSS) vulnerability in the file app/fifo_list/fifo_interactive.php, exploitable via the c parameter. The issue allows remote attackers to inject arbitrary web script or HTML. The affected component is the fifo_interactive.php script within Fus...

CVE-2019-19366

A cross-site scripting XSS vulnerability in app/xmlcdr/xmlcdrsearch.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

CVE-2019-19366

FusionPBX 4.4.1 is affected by a cross-site scripting (XSS) vulnerability in the web UI: the redirect parameter in app/xml_cdr/xml_cdr_search.php can be abused to inject arbitrary script/HTML. Public references (NVD) list CVE-2019-19366 with a network-exposed impact and provide CVSS vectors (2.0/...

CVE-2019-19366

A cross-site scripting XSS vulnerability in app/xmlcdr/xmlcdrsearch.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

CVE-2019-19367

The CVE-2019-19367 entry concerns FusionPBX 4.4.1, where a cross-site scripting (XSS) flaw exists in the file app/fax/fax_files.php. The vulnerability is triggered via the id parameter and allows remote attackers to inject arbitrary web script or HTML. Publicly available connected sources consist...

TYPO3 FLUID Templating Engine Cross-Site Scripting Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. FLUID Templating Engine is one of the templating engines.A cross-site scripting vulnerability exists in FLUID Templating Engine in TYPO3 versions prior to 4.3.4 and 4.4.x versions prior to...

CVE-2010-3673

TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API...

CVE-2010-3674

TYPO3 before 4.4.1 allows XSS in the frontend search box...

CVE-2010-3670

TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot password" function...

CVE-2010-3668

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Header Injection in the secure download feature jumpurl...

CVE-2019-6470

There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All...

DEBIAN-CVE-2019-6470

There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All...

CVE-2019-6470 dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries

There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All...

CVE-2019-6470

There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All...

CVE-2019-18205

CVE-2019-18205 affects Zucchetti InfoBusiness

CVE-2019-18219

Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting XSS vulnerability, as it fails to validate user input. The affected components index.php, upgrade.php allow for JavaScript injection within both GET or POST requests, via a crafted URL or via the UpgradeMode POST parameter...

CVE-2019-18220

CVE-2019-18220 affects Sitemagic CMS 4.4.1. The root cause is a cross-site request forgery (CSRF) issue where the application does not implement any method to validate incoming requests, enabling a remote unauthenticated attacker to induce victims to perform unintended actions. The provided conne...