CVE-2019-20426

In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. In the function ldlmcancelhpreqcheck, there is no lockcount bounds check...

CVE-2019-17201

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying service...

Cisco Email Security Appliance Cross-Site Scripting Vulnerability

Cisco Email Security Appliance ESA is an email security appliance from Cisco in the U.S. AsyncOS Software is the operating system that runs on it. A cross-site scripting vulnerability exists in the Cisco Email Security Appliance 13.0 and prior versions. The vulnerability stems from a lack of prop...

SAP Disclosure Management Cross-Site Scripting Vulnerability (CNVD-2020-03253)

SAP Disclosure Management is an automated financial disclosure management system from SAP. The system provides a collaborative financial disclosure process across teams, geographies, systems and data sources. A cross-site scripting vulnerability exists in SAP Disclosure Management versions prior ...

UHP UHP-100 cross-site scripting vulnerability (CNVD-2020-07243)

The UHP-100 is a high-performance router designed for large-scale deployment in broadband VSAT networks. A cross-site scripting vulnerability exists in UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker...

TestLink cross-site scripting vulnerability (CNVD-2020-03254)

TestLink is a set of open source software for managing the software testing process and providing statistical analysis. A cross-site scripting vulnerability exists in TestLink versions prior to 1.9.20. The vulnerability stems from a lack of proper validation of client-side data by the WEB...

Piwigo Cross-Site Scripting Vulnerability (CNVD-2020-03257)

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A cross-site scripting vulnerability exists in Piwigo. The vulnerability stems from the lack of proper validation of client-side data ...

Piwigo Cross-Site Scripting Vulnerability (CNVD-2020-03256)

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A cross-site scripting vulnerability exists in Piwigo. The vulnerability stems from the lack of proper validation of client-side data ...

Cacti Cross-Site Scripting Vulnerability (CNVD-2020-04005)

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . A cross-site scripting vulnerability exists in several files in Cac...

Serpico Cross-Site Scripting Vulnerability

Serpico is a penetration test report generation and collaboration tool. Serpico suffers from a cross-site scripting vulnerability. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability to execute client-side...

WordPress chained-quiz cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. chained-quiz is a chained quiz creation plugin used in it. A cross-site scripting vulnerability exists in WordPress chained-quiz versi...

CVE-2019-17127

A Stored Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation...

CVE-2019-17127

A Stored Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation...

CVE-2019-17125

A Reflected Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS...

CVE-2019-17125

A Reflected Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS...

Cross site scripting

A Reflected Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS...

CVE-2019-17127

Summary: CVE-2019-17127 describes a Stored Client Side Template Injection (CSTI) in SolarWinds Orion Platform 2019.2 HF1. The vulnerability allows an attacker to inject an Angular expression and escape the Angular sandbox, causing stored XSS and potential privilege escalation. The affected compon...

Transcend WiFiSD Cross-Site Scripting Vulnerability

Transcend WiFiSD is a WiFi-enabled memory card product from Transcend Taiwan, China. A cross-site scripting vulnerability exists in Transcend WiFiSD version 1.8. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the...

WordPress flog cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress flog version 0.1. The vulnerability stems from a lack...

ovirt-engine cross-site scripting vulnerability

ovirt-engine is an open source virtualization management engine. A cross-site scripting vulnerability exists in ovirt-engine. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...