[20210304] - Core - XSS within the feed parser library

Missing filtering of feed fields could lead to xss issues...

CVE-2020-11010

In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, startswith, or endswith filters and their case-insensitive...

SQL injection in Tortoise ORM

Impact Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL was only affected when filtering with contains, startswith or endswith filters and their case-insensitive counterparts Patches Please upgrade to 0.15.2...

Cross-Site Scripting (XSS)

prestashop/pssocialfollow is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the social network fields...

CVE-2020-1018

An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a mask...

Cumulative Update 41 for Microsoft Dynamics NAV 2017 (Build 30219)

Cumulative Update 41 for Microsoft Dynamics NAV 2017 Build 30219 This article applies to Microsoft Dynamics NAV 2017 for all countries and all language locales. An information disclosure vulnerability exists if Microsoft Dynamics Business Central/NAV on-premises does not correctly hide the value ...

Microsoft Dynamics Business Central/NAV Information Disclosure

An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page. The attacker who successfully exploited the vulnerability could see the information that are in a...

CVE-2019-20635

codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields...

Code injection

codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields...

CVE-2020-11490

Manage::Certificates in Zen Load Balancer 3.10.1 allows remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the index.cgi certissuer, certdivision, certorganization, certlocality, certstate, certcountry, or certemail parameter...

Mail.ru: Stored XSS on {https://calendar.mail.ru/}

Stored XSS via event fields in calendar.mail.ru...

WordPress: CSRF in Profile Fields allows deleting any field in BuddyPress

Description: CSRF in Profile Fields allows deleting any field in BuddyPress Version: Latest Steps To Reproduce: Step1: Using a form like so to create the CSRF: history.pushState'', '', '/' Change your domain and idfield Step 2: When admin click with step 1 was hidden in images,.... Step1 will all...

DEBIAN-CVE-2020-1769

In the login screens in agent and customer interface, Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: OTRS Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions...

Exploit for Incorrect Authorization in Joomla Joomla\!

Made by HK CVE-2020-10239: Incorrect Access Control in comf...

VulnCheck KEV: CVE-2025-34129

A command injection vulnerability exists in LILIN Digital Video Recorder DVR devices prior to firmware version 2.0b6020200207 due to insufficient sanitization of the FTP and NTP Server fields in the service configuration. An attacker with access to the configuration interface can upload a...

elysianfields.com.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1119893 Security Researcher haxmov Helped patch 708 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting elysianfields.com.br website...

CVE-2019-19852

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9, 14.x through 14.0.2.14, and 15.x through 15.0.15.4...

Cross site scripting

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9, 14.x through 14.0.2.14, and 15.x through 15.0.15.4...

CVE-2019-19852

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9, 14.x through 14.0.2.14, and 15.x through 15.0.15.4...

CVE-2019-19852

An XSS injection vulnerability exists in Sangoma FreePBX and PBXact (13–15) within the Call Event Logging (cel) module, exploitable via the admin/config.php?display=cel page using date fields. Affected versions include cel up to 13.0.26.9, 14.x up to 14.0.2.14, and 15.x up to 15.0.15.4. The root ...