Quest Software KACE Systems Management Appliance Cross-Site Scripting Vulnerability

Quest Software KACE Systems Management Appliance is a systems management appliance from Quest Software, USA. It supports IT asset management, server management and monitoring, software license management and patch management. A cross-site scripting vulnerability exists in Quest Software KACE...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2019-15665)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in Mozilla Firefox versions prior to 67, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit thi...

Computrols CBAS Web Cross-Site Scripting Vulnerability

Computrols CBAS is a building automation system from Computrols USA. A cross-site scripting vulnerability exists in Computrols CBAS Web. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute...

CVE-2019-11536

Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561. The...

Input validation

Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561. The...

CVE-2019-11536

Summary (CVE-2019-11536) Kalkitech SYNC3000 Substation DCU GPC versions 2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1 are affected when WebHMI is not installed. The issue allows an attacker to inject client-side commands or scripts that are executed on the de...

TP-LINK TL-WR840N v5 XSS Injection Vulnerability

The TP-Link TL-WR840N is a wireless router from China P&L TP-Link. A cross-site scripting vulnerability exists in TP-LINK TL-WR840N v5 00000005 using firmware version 0.9.1 3.16 v0001.0 Build 171211 Rel.58800n. The vulnerability stems from the lack of proper validation of client data by the WEB...

Zoho ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-15667)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...

CentOS Web Panel Cross-Site Scripting Vulnerability (CNVD-2019-15668)

CentOS Web Panel CWP is a free web hosting control panel. A cross-site scripting vulnerability exists in CWP 0.9.8.747 and earlier versions. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...

Applaud HCM Cross-Site Scripting Vulnerability

Applaud HCM is a human resource management application. A cross-site scripting vulnerability exists in Applaud HCM version 4.0.42+ that can be exploited by an attacker to execute client-side code...

eZ Platform Admin UI Cross-Site Scripting Vulnerability

eZ Platform is an open source enterprise content management system CMS. admin UI is one of the back-end management interface . A cross-site scripting vulnerability exists in the Admin UI in eZ Platform version 2.x, which can be exploited by an attacker to execute client-side code...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2019-25043)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

Design/Logic Flaw

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12098

CVE-2019-12098 affects Heimdal Kerberos 5 clients; the issue is failure to verify anonymous PKINIT KX (PA-PKINIT-KX) during the key exchange, enabling potential MITM. Public advisories indicate this was fixed in newer Heimdal releases (e.g., 7.6.0+ and later such as 7.7.0 in openSUSE/SUSE bundles...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

Seagate NAS OS Cross-Site Scripting Vulnerability

Seagate NAS OS is a NAS Network Attached Storage operating system from Seagate USA. A cross-site scripting vulnerability exists in the API error page in Seagate NAS OS version 4.3.15.1. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker cou...

IBM Rational DOORS Web Access Cross-Site Scripting Vulnerability (CNVD-2019-15711)

IBM Rational DOORS Web Access is a requirements collaboration solution from IBM USA. The product supports creating, analyzing, editing, and discussing requirements and other A cross-site scripting vulnerability exists in IBM Rational DOORS Web Access versions 9.5.1 through 9.5.2.9 and 9.6 through...

Joomla! cross-site scripting vulnerability (CNVD-2019-15713)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A cross-site scripting vulnerability exists in versions of Joomla! prior to 3.9.6. The vulnerability stems from a lack of proper validation of...

Simditor cross-site scripting vulnerability (CNVD-2019-14696)

Simditor is a browser-based WYSIWYG text editor. A cross-site scripting vulnerability exists in Simditor 2.3.21 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...