Jiangnan Online Judge Cross-Site Scripting Vulnerability (CNVD-2019-36852)

Jiangnan Online Judge is an online evaluation system for computer programming. The system is mainly used for compiling and executing the source code submitted by users and checking the correctness of the program source code. A cross-site scripting vulnerability exists in Jiangnan Online Judge...

laravel-bjyblog cross-site scripting vulnerability

laravel-bjyblog is an open source personal blog system. A cross-site scripting vulnerability exists in laravel-bjyblog version 6.1.1, which stems from the lack of proper validation of client-side data in the WEB application and can be exploited by an attacker to execute client-side code...

WordPress htaccess plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. htaccess is an access control plugin used in it. A cross-site scripting vulnerability exists in the WordPress htaccess plugin versions...

CVE-2019-17507

An issue was discovered on D-Link DIR-816 A1 1.06 devices. An attacker could access management pages of the router via a client that ignores the 'top.location.href = "/dirlogin.asp"' line in a .asp file. This provides access to dstatus.asp, version.asp, ddhcptbl.asp, and dacl.asp...

WordPress display-widgets plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. display-widgets is a widget display plugin used in it. A cross-site scripting vulnerability exists in WordPress display-widgets...

cPanel cross-site scripting vulnerability (CNVD-2019-34451)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the SSL Certificate Upload interface in versions of cPanel prior to 82.0.15. The...

WordPress dynamic-widgets plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. dynamic-widgets is a dynamic widget management plugin used in it. A cross-site scripting vulnerability exists in WordPress...

WordPress animate-it plugin cross-site scripting vulnerability (CNVD-2019-34454)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. animate-it is a plugin used to add CSS3 animations to web pages. A cross-site scripting vulnerability exists in WordPress animate-it...

noVNC Cross-Site Scripting Vulnerability

noVNC is an HTML VNC Virtual Network Computing client library. A cross-site scripting vulnerability exists in versions of noVNC prior to 0.6.2. The vulnerability stems from the lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to...

cPanel cross-site scripting vulnerability (CNVD-2019-34455)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the WHM Update Preferences interface in versions of cPanel prior to 82.0.15. The...

Cross-Site Scripting (XSS) in script src

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Cross Site Scripting XSS allows clients to inject scripts into a request and have th...

Magento cross-site scripting vulnerability (CNVD-2019-34460)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento cross-site scripting vulnerability , the vulnerability stems from the lack of WEB applications on the...

OpenProject Cross-Site Scripting Vulnerability

OpenProject is an open source Web-based project management software . The software has project planning , task management , bug tracking and cost budgeting and other functions . A cross-site scripting vulnerability exists in the project list in OpenProject versions prior to 9.0.4 and 10.x version...

Magento cross-site scripting vulnerability (CNVD-2019-34461)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento cross-site scripting vulnerability , the vulnerability stems from the lack of WEB applications on the...

Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe vulnerabilities could allow an attacker to execute arbitrary co...

Jiangnan Online Judge Cross-Site Scripting Vulnerability

Jiangnan Online Judge is an online evaluation system for computer programming. The system is mainly used for compiling and executing the source code submitted by users and checking the correctness of the program source code. A cross-site scripting vulnerability exists in Jiangnan Online Judge...

b3log Symphony cross-site scripting vulnerability (CNVD-2019-34789)

b3log Symphony Sym is a modern open source community platform written in the Java language. A cross-site scripting vulnerability exists in b3log Symphony versions prior to 3.6.0, which stems from the lack of proper validation of client-side data by the WEB application and can be exploited by an...

Exploit for Incorrect Default Permissions in Kramerav Viaware

Exploit Title: KRAMER VIAware 2.5.0719.1034 - Remote Code Exec...

CVE-2018-1272

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application server A receives input from a remote client, and then uses that input to make a...

Magecart Group 4: A link with Cobalt Group?

Note: This blog post is a collaboration between the Malwarebytes and HYAS Threat Intelligence teams. Magecart is a term that has become a household name, and it refers to the theft of credit card data via online stores. The most common scenario is for criminals to compromise e-commerce sites by...