Horde Groupware Webmail 跨站脚本漏洞

Horde Groupware Webmail is a browser-based, enterprise-class communications suite from Horde, Inc. A cross-site scripting vulnerability exists in Horde Groupware Webmail Edition, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this...

Advisto PEEL SHOPPING Cross-Site Scripting Vulnerability

Advisto PEEL SHOPPING is an open source e-commerce system based on PHP and MySQL. A cross-site scripting vulnerability exists in Advisto PEEL SHOPPING, which arises from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute...

IBM Case Manager 跨站脚本漏洞

IBM Case Manager is a solution for managing cases from IBM USA. The solution supports the combination of content, processes and people, and provides frameworks, relevance methods and integration tools to view a holistic view of cases. A cross-site scripting vulnerability exists in IBM Case Manage...

Tufin SecureTrack R20-2 GA Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in the Tufin SecureTrack R20-2 GA that stems from a lack of proper validation of client-side data by a WEB application. An attacker can exploit this vulnerability to execute client-side code...

Korzio Djv 命令注入漏洞

Korzio Djv is Korzio individual developers of a Javascript-based software used to dynamically verify the Json data format . A command injection vulnerability exists in versions prior to djv 2.1.4, which stems from the lack of proper validation of client-side data by the web application. An attack...

CVE-2020-26174

tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. However, this restriction is enforced in the browser client-side and can be circumvented. This allows an attacker to upload any file as an...

SourceCodester Online Examination System 跨站脚本漏洞

SourceCodester Online Examination System is an online examination system from SourceCodester, Inc. A cross-site scripting vulnerability exists in SourceCodester Online Examination System 1.0, which stems from a WEB application's lack of proper validation of The vulnerability is caused by the lack...

reddoxx maildepot Cross-Site Scripting Vulnerability

reddoxx maildepot reddoxx maildepot is an e-mail archiving software from German reddoxx. The software stores all e-mails automatically and permanently in an archive independent of the mail server. A cross-site scripting vulnerability exists in MailDepot version 2033 2.3.3022, which stems from a...

XooNIps Cross-Site Scripting Vulnerability (CNVD-2020-63192)

XooNIps is a content management system for the field of neuroscience by the XooNIps team in Japan. A cross-site scripting vulnerability exists in XooNIps version 3.49 and prior versions, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can explo...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2020-60334)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in OX App Suite version 7.10.3 and prior versions, which stems from a la...

SysAid Technologies SysAid Cross-Site Scripting Vulnerability

SysAid Technologies SysAid is a suite of IT service management solutions from SysAid Technologies, Israel. A cross-site scripting vulnerability exists in SysAid Technologies SysAid version 20.1.11b26. The vulnerability stems from a lack of proper validation of client-side data by the web...

GHSA-6495-8JVH-F28X File restriction bypass in socket.io-file

All versions of socket.io-fileare vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the name value to upload any file types. No fix is currently...

File restriction bypass in socket.io-file

All versions of socket.io-fileare vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the name value to upload any file types. No fix is currently...

GitLab Cross-Site Scripting Vulnerability (CNVD-2020-57834)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab...

CloudBees Jenkins Validating String Parameter Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

KaiOS Recorder Cross-Site Scripting Vulnerability (CNVD-2020-52886)

KaiOS is a Linux-based mobile operating system. A cross-site scripting vulnerability exists in KaiOS version 2.5. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

KaiOS Contacts Cross-Site Scripting Vulnerability

KaiOS is a Linux-based mobile operating system. A cross-site scripting vulnerability vulnerability exists in KaiOS versions 2.5 and 2.5.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...

Facebook WhatsApp Desktop Cross-Site Scripting Vulnerability

Facebook WhatsApp is a suite of mobile applications from the American company Facebook that utilize the web to deliver text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, and more. A cross-site scripting...

CloudBees Jenkins Git XSS Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/testing project and some timed tasks.LTS is a long-term support for CloudBees...

Collabtive XSS Vulnerability

Collabtive is a web-based project management system. The system includes features such as project management, document management and time tracking. Collabtive 3.0 and later versions suffer from an XSS vulnerability that stems from a lack of proper validation of client-side data in the WEB...