CVE-2019-19898: Cleartext Transmission of Sensitive Information

In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely...

The vulnerability in the Administrator web console of the McAfee Web Gateway web server allows a perpetrator to carry out a clickjacking attack.

The vulnerability of the Administrator web console of the McAfee Web Gateway lies in insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to carry out a clickjacking attack using a specially crafted web page...

PT-2019-18459 · Synology · Video Station

Name of the Vulnerable Software and Affected Versions: Video Station versions prior to the latest version Description: This issue allows remote attackers to inject and execute scripts on the administrator’s management console through a cross-site scripting XSS vulnerability in Video Station...

CVE-2019-7197

A stored cross-site scripting XSS vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version...

Cross site scripting

A stored cross-site scripting XSS vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version...

CVE-2019-7197

A stored cross-site scripting XSS vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version...

PT-2019-18461

Name of the Vulnerable Software and Affected Versions QTS versions prior to the latest version Description A stored cross-site scripting XSS issue has been reported, which may allow an attacker to inject and execute scripts on the administrator console. Recommendations Update QTS to the latest...

CVE-2019-7197: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version...

McAfee Web Gateway Input Validation Error Vulnerability

McAfee Web Gateway MWG is a security gateway product from McAfee USA. The product provides threat protection, application control, and data loss prevention. An input validation error vulnerability exists in the administrator web console in McAfee MWG versions 7.8.2.x prior to 7.8.2.12, which can ...

Authentication flaw

A vulnerability in the Virtual Network Computing VNC console implementation of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an...

Joomla Core 3.9.1 - Persistent Cross-Site Scripting in Global Configuration Textfilter Settings

Exploit for php platform in category web applications Exploit Title: Joomla Global Configuration Text Filter settings Stored XSS Vulnerability Exploit Author: Praveen Sutar , Twitter: @praveensutar123 Vendor Homepage: https://www.joomla.org/ Affected Versions: Joomla versions 2.5.0 through 3.9.1...

BlackBerry Unified Endpoint Manager Cross-Site Scripting Vulnerability (CNVD-2019-39169)

BlackBerry Unified Endpoint Manager UEM is a unified endpoint management solution from BlackBerry Canada. The solution is used to manage endpoint devices and view their access. A security vulnerability exists in BlackBerry UEM. No information is currently available about this vulnerability, which...

Update Rollup 13 for System Center 2012 R2 Data Protection Manager

Update Rollup 13 for System Center 2012 R2 Data Protection Manager Introduction This article describes the issues that are fixed in Update Rollup 13 for Microsoft System Center 2012 R2 Data Protection Manager. It also contains the installation instructions for this update. Note Existing Data...

CVE-2016-5760

The vulnerability CVE-2016-5760 affects Micro Focus/Novell GroupWise (administrator console) prior to 2014 R2 Service Pack 1 Hot Patch 1. It enables cross-site scripting by exploiting insufficient input sanitization in the admin console: (1) token parameter to gwadmin-console/install/login.jsp an...

PT-2017-8769

Name of the Vulnerable Software and Affected Versions Novell GroupWise versions prior to 2014 R2 Service Pack 1 Hot Patch 1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the administrator console. These vulnerabilities allow remote attackers to inject arbitra...

Update Rollup 11 for System Center 2012 R2 Virtual Machine Manager

Update Rollup 11 for System Center 2012 R2 Virtual Machine Manager Introduction This article describes the issues that are fixed in Update Rollup 11 for Microsoft System Center 2012 R2 Virtual Machine Manager. There are two updates available for System Center 2012 R2 Virtual Machine Manager: one...

Novell Micro Focus GroupWise Multiple Cross Site Scripting (CVE-2016-5760)

A cross-site scripting vulnerability has been reported in the administrator console of Micro Focus GroupWise. The vulnerability is due to failure to properly sanitize user-supplied input. A remote attacker can exploit this vulnerability by enticing a target user to click on a specially crafted UR...

Novell Micro Focus GroupWise Multiple Cross Site Scripting (CVE-2016-5760)

A cross-site scripting vulnerability has been reported in the administrator console of Micro Focus GroupWise. The vulnerability is due to failure to properly sanitize user-supplied input. A remote attacker can exploit this vulnerability by enticing a target user to click on a specially crafted UR...

TP-Link Archer CR-700 Cross Site Scripting

Exploit Title: TP-Link Archer CR-700 XSS vulnerability Google Dork: N/A Date: 09/07/2016 Exploit Author: Ayushman Dutta Vendor Homepage: http://www.tp-link.us/ Software Link: N/A Version: 1.0.6 REQUIRED Tested on: Linux CVE : N/A Exploit Information:...

Google Apps Flaw Allowed Hacker to Hijack Account and Disable Two-factor Authentication

A critical cross-site scripting XSS vulnerability in the Google Apps administrator console allowed cyber criminals to force a Google Apps admins to execute just about any request on the domain. The Google Apps admin console allows administrators to manage their organization’s account...