Zotonic < 0.47.0 mod_admin - Cross-Site Scripting

Exploit Title: Zotonic prompt‘XSS’ Affected source code file zotonicmodadmin: - zotonicmodadminidentity\priv\templates\adminsortheader.tpl - zotonicmodadminidentity\priv\templates\adminusers.tpl References http://docs.zotonic.com/en/latest/developer-guide/releasenotes/rel0.47.0.html...

EulerOS 2.0 SP2 : libxslt (EulerOS-SA-2019-1317)

According to the version of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receivi...

Cross site scripting

A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface...

Cross site scripting

Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL...

CVE-2019-9841

Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL...

CVE-2019-9841

Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL...

CVE-2019-9841

Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL...

PT-2019-19889

Name of the Vulnerable Software and Affected Versions Vesta Control Panel version 0.9.8-23 Description The issue allows for cross-site scripting XSS attacks through a crafted URL. Recommendations For Vesta Control Panel version 0.9.8-23, update to a newer version that contains a fix for this issu...

CVE-2019-9841: Improper Neutralization of Input During Web Page Generation

Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL...

CVE-2019-4178

IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to write or view arbitrary files on the system. IBM X-Force ID: 158919...

CVE-2019-11068

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...

Authentication flaw

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...

CVE-2019-11068

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...

CVE-2019-11068

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...

libxslt -- security framework bypass

Mitre report: libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...

CVE-2019-0801

A remote code execution vulnerability exists when Microsoft Office fails to properly handle certain files.To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted URL file that points to an Excel or PowerPoint file that was also downloaded.The update...

Synology Web Station Input Validation Error Vulnerability

Synology Web Station is an application that supports the creation of personal web sites by Synology Inc. of Taiwan, China. An input validation error vulnerability exists in Synology Web Station. An attacker could exploit this vulnerability to conduct a phishing attack with the help of a specially...

CVE-2017-6049

Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially crafted URL...

CVE-2018-1618

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 144343...

PT-2019-8585

Name of the Vulnerable Software and Affected Versions Detcon Sitewatch Gateway versions without cellular Description An issue exists where an attacker can edit settings on the device using a specially crafted URL. Recommendations For Detcon Sitewatch Gateway versions without cellular, at the...