PT-2020-3824 · Microsoft · Windows Csc Service +1

Name of the Vulnerable Software and Affected Versions: Windows CSC Service affected versions not specified Description: The issue is related to the improper handling of memory by the Windows CSC Service, which can lead to an elevation of privilege. To exploit this, an attacker must first gain...

BugPoC: DOM based Cross-site Scripting

Summary: The postMessage API is an alternative to JSONP, XHR with CORS headers and other methods enabling sending data between origins. It was introduced with HTML5 and like many other cross-document features it can be a source of client-side vulnerabilities. Steps To Reproduce: Visit -...

Jeedom Cross-Site Scripting Vulnerability

Jeedom is an open source home automation solution for the Internet of Things. A cross-site scripting vulnerability exists in Jeedom 4.0.38 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the...

Plesk Obsidian Cross-Site Scripting Vulnerability

Plesk Obsidian is a mainframe control panel from the Swiss company Plesk. A cross-site scripting vulnerability exists in Plesk Obsidian version 18.0.17. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability ...

Plesk Onyx Cross-Site Scripting Vulnerability

Plesk Onyx is a hosting control panel from the Swiss company Plesk. A cross-site scripting vulnerability exists in Plesk Onyx version 17.8.11. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability to execute...

Tiki Cross-Site Scripting Vulnerability (CNVD-2020-44400)

Tiki is a suite of open source content management and portal applications from the Tiki community that can be used to create web applications, portals, corporate intranets, extranets, and more. A cross-site scripting vulnerability exists in versions prior to Tiki 21.2. The vulnerability stems fro...

GitLab: Store-XSS in error message of build-dependencies

Hi, A stored-XSS is existing in error message of build-dependencies. Fortunately it currently does not exist in gitlab.com. It seems that gitlab.com disables the dependencies validation. However this feature is enable by default in self-managed installation. Steps to reproduce The following steps...

TYPO3 dlf extension cross-site scripting vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. dlf extension is one of the digital library extensions. A cross-site scripting vulnerability exists in TYPO3 dlf extension version 3.1.1 and earlier versions, which stems from the lack of...

Nagios Log Server Cross-Site Scripting Vulnerability (CNVD-2020-43761)

Nagios Log Server is a set of centralized log management, monitoring and analysis software from Nagios, Inc. A cross-site scripting vulnerability exists in Nagios Log Server versions prior to 2.1.7. The vulnerability stems from the lack of proper validation of client-side data by the WEB...

KonaWiki Cross-Site Scripting Vulnerability

KonaWiki is a lightweight Wiki system. The system is primarily used for writing manuscripts, keeping minutes and memos, etc. A cross-site scripting vulnerability exists in KonaWiki 2.2.0 and earlier versions. The vulnerability stems from the WEB application lacking proper validation of client-sid...

KonaWiki cross-site scripting vulnerability (CNVD-2020-43669)

KonaWiki is a lightweight Wiki system. The system is primarily used for writing manuscripts, keeping minutes and memos, etc. A cross-site scripting vulnerability exists in KonaWiki 3.1.0 and earlier versions. The vulnerability stems from the WEB application lacking proper validation of client-sid...

CVE-2020-15588

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM...

CVE-2020-15588

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM...

Teltonika TRB245 Cross-Site Scripting Vulnerability

Teltonika TRB245 is a cellular network gateway product from Teltonika Lithuania. A cross-site scripting vulnerability exists in Teltonika TRB245 using firmware version TRB2R00.02.02. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker can...

HCL Technologies BigFix Platform BigFix WebUI Cross-Site Scripting Vulnerability

HCL Technologies BigFix Platform is a suite of endpoint security management platform from HCL Technologies, India. The platform supports automated discovery, management and remediation of endpoint security issues.HCL BigFix WebUI is a console program for the BigFix Platform. A cross-site scriptin...

October CMS Cross-Site Scripting Vulnerability (CNVD-2020-43155)

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A cross-site scripting vulnerability exists in October CMS versions prior to 1.0.319 and prior to 1.0.466. The vulnerability stems from a lack of proper validation of client-side data b...

SilverStripe Cross-Site Scripting Vulnerability (CNVD-2020-42956)

SilverStripe is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . Silverstripe 4.5 and previous versions of cross-site scripting vulnerability. The...

OSIsoft PI Vision Cross-Site Scripting Vulnerability (CNVD-2020-44877)

OSIsoft PI Vision is a suite of visualization tools from OSIsoft, Inc. that supports accessing PI System data from mobile devices. It supports self-configuration of trends, images, data values, and more in order to present data information. A cross-site scripting vulnerability exists in OSIsoft P...

Elasticsearch Kibana Cross-Site Scripting Vulnerability (CNVD-2020-49490)

Elasticsearch Kibana is a suite of open source, browser-based analytics and search Elasticsearch dashboard tools from Elasticsearch Netherlands. A cross-site scripting vulnerability exists in Elasticsearch Kibana versions prior to 6.8.11 and prior to 7.8.1. The vulnerability stems from the WEB...

Mida Solutions eFramework Cross-Site Scripting Vulnerability

Mida Solutions eFramework is a suite of unified communications and collaboration services from Mida Solutions, Italy. A cross-site scripting vulnerability exists in Mida Solutions eFramework version 2.9.0 and earlier. The vulnerability stems from a lack of proper validation of client-side data by...