Cross site scripting

A Dom-based Cross-site scripting XSS vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inject arbitrary web script or HTML via the groupId parameter...

Cyclos 4 PRO 跨站脚本漏洞

Cyclos 4 PRO is a web server. A cross-site scripting vulnerability exists in Cyclos 4 PRO version 4.14.7 and earlier, which can be exploited by remote attackers to inject arbitrary web scripts or HTML via the groupId parameter...

CVE-2021-31673: Improper Neutralization of Input During Web Page Generation

A Dom-based Cross-site scripting XSS vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inject arbitrary web script or HTML via the groupId parameter...

PT-2022-10043

Name of the Vulnerable Software and Affected Versions Cyclos 4 PRO versions 4.14.7 and earlier Description A Dom-based Cross-site scripting XSS issue exists at the registration account in Cyclos, allowing remote attackers to inject arbitrary web script or HTML via the groupId parameter. This...

CVE-2021-28129 DEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupid

While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500. This both caused issues with desktop integration and could allow a crafted attack on files owned by that user or group if they exist. User...

NukeViet Shops SQL Injection

The vulnerability of the Shops module in the NukeViet content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code through the listid parameter in the detail.php script, ...

Vinades NukeViet SQL注入漏洞

Vinades NukeViet is an open source Content Management System CMS from Vinades Vietnam. A SQL injection vulnerability exists in NukeViet CMS due to a failure to filter special characters in the listid parameter on the detail.php page of the product store module and the groupprice and groupid...

CVE-2020-21809

SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the 1 listid parameter in detail.php and the 2 groupprice or groupid parameters in searchresult.php...

CVE-2020-21809

Summary: CVE-2020-21809 is a SQL Injection vulnerability in the NukeViet CMS module Shops affecting versions 4.0.29 and 4.3, exploitable via improper handling of input parameters (listid in detail.php; group_price or groupid in search_result.php). The vulnerability is documented with high/critica...

CVE-2020-21809: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the 1 listid parameter in detail.php and the 2 groupprice or groupid parameters in searchresult.php...

PT-2019-6070

Name of the Vulnerable Software and Affected Versions NukeViet CMS module Shops versions 4.0.29 through 4.3 Description The issue is related to a lack of protection against SQL query structure attacks. Exploitation of this issue may allow a remote attacker to execute arbitrary SQL code through th...

CVE-2019-7426: Improper Neutralization of Input During Web Page Generation

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the groupDesc, groupName, groupID, or task parameter...

PT-2019-18600

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2 Description A security issue exists in the Administration zone of the software, specifically in the "/netflow/jspui/linkdownalertConfig.jsp" file. The issue is related to the...

CVE-2018-19773

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "EditCurrentUser.jsp" has reflected XSS via the GroupId and ConnPoolName parameters...

CVE-2018-19774

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "PresentSpace.jsp" has reflected XSS via the GroupId and ConnPoolName parameters...

CVE-2018-19810

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "/VPortal/mgtconsole/GroupMove.jsp" has reflected XSS via the ConnPoolName, GroupId, or type parameter...

CVE-2018-19812

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "/VPortal/mgtconsole/SubFolderPackages.jsp" has reflected XSS via the GroupId parameter...

CVE-2018-19773

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "EditCurrentUser.jsp" has reflected XSS via the GroupId and ConnPoolName parameters...

CVE-2018-19772

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "EditCurrentPresentSpace.jsp" has reflected XSS via the ConnPoolName, GroupId, and ParentId parameters...

CVE-2018-19813

Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "/VPortal/mgtconsole/Subscribers.jsp" has reflected XSS via the ConnPoolName or GroupId parameter...