CVE-2019-6513: Unrestricted Upload of File with Dangerous Type

An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one...

PT-2019-18131

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0 Description An issue was discovered that allows a logged-in user to upload any type of file as API documentation by changing the file extension to an allowed one. Recommendations For WSO2 API Manager version 2.6....

CVE-2019-9709

An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting XSS due to not escaping it when viewing the collection's SmartEvidence overview page if that feature is turned on. This can be exploit...

Cross site scripting

An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting XSS due to not escaping it when viewing the collection's SmartEvidence overview page if that feature is turned on. This can be exploit...

CVE-2019-9709

An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting XSS due to not escaping it when viewing the collection's SmartEvidence overview page if that feature is turned on. This can be exploit...

CVE-2019-9709: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting XSS due to not escaping it when viewing the collection's SmartEvidence overview page if that feature is turned on. This can be exploit...

UBUNTU-CVE-2014-1427

A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting. This issue affects MAAS versions prior to 1.9.2...

CVE-2014-1427: Improper Neutralization of Input During Web Page Generation

A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting. This issue affects MAAS versions prior to 1.9.2...

DirectAdmin 1.55 - CMD_ACCOUNT_ADMIN Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit title: DirectAdmin v1.55 - CSRF via CMDACCOUNTADMIN Admin Panel Exploit Author: ManhNho Vendor Homepage: https://www.directadmin.com/ Software Link: https://www.directadmin.com/ Demo Link: https://www.directadmin.com:2222/CMDACCOUNTADM...

Microsoft Chakra Scripting Engine Remote Memory Corruption Vulnerability

Microsoft Windows 10 is an operating system released by Microsoft Corporation in the U.S. Edge is one of the browsers that comes with the system.ChakraCore is the core of an open source JavaScript engine used in Edge, and can also be used as a standalone JavaScript engine. A remote memory...

Microsoft Edge Remote Memory Corruption Vulnerability (CNVD-2019-00763)

Microsoft Windows 10 is an operating system released by Microsoft Corporation in the U.S. Edge is one of the browsers that comes with the system. A remote memory corruption vulnerability exists in Microsoft Edge. An attacker can exploit the vulnerability to execute arbitrary code in the context o...

Microsoft SharePoint Server Information Disclosure Vulnerability

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. An information...

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

WordPress plugin LearnPress cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin LearnPress, which can be exploited by an attacker to...

WordPress Plugin Event Calendar WD Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Event Calendar WD, which could allow an attacker to execu...

WordPress plugin "Event Calendar WD" vulnerable to cross-site scripting

Overview The WordPress plugin "Event Calendar WD" provided by Web-Dorado contains a stored cross-site scripting vulnerability CWE-79. Yuta Kitaoka of TokyoDenkiUniversity Cryptography Lab reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

JVN#75738023: WordPress plugin "Event Calendar WD" vulnerable to cross-site scripting

The WordPress plugin "Event Calendar WD" provided by Web-Dorado contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on a logged-in user's web browser. Solution Update the plugin Update the plugin according to the information provided by the...

Microsoft Edge Chakra Scripting Engine Remote Memory Corruption Vulnerability (CNVD-2018-21216)

Edge is the default browser that comes with Microsoft's operating systems. A bad remote memory corruption vulnerability exists in Microsoft Edge Chakra Scripting Engine. An attacker can exploit this vulnerability to execute arbitrary code in the context of the currently logged in user. A failed...

Microsoft Edge Remote Memory Corruption Vulnerability (CNVD-2018-21211)

Edge is the default browser that comes with Microsoft's operating systems. A remote memory corruption vulnerability exists in Microsoft Edge. An attacker can exploit this vulnerability to execute arbitrary code in the context of the currently logged in user. A failed attack would result in a deni...

CVE-2018-18087

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...