Privilege escalation

Privilege Escalation vulnerability in McAfee VirusScan Enterprise VSE for Windows prior to 8.8 Patch 14 Hotfix 116778 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is...

Privilege escalation

Privilege Escalation vulnerability in McAfee Endpoint Security ENS for Mac prior to 10.6.9 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a...

CVE-2020-7266 Privilege Escalation vulnerability through symbolic links in VSE for Windows

Privilege Escalation vulnerability in McAfee VirusScan Enterprise VSE for Windows prior to 8.8 Patch 14 Hotfix 116778 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is...

Online Clothing Store 1.0 Cross Site Scripting

Exploit Title: Online Clothing Store 1.0 - Persistent Cross-Site Scripting Date: 2020-05-05 Exploit Author: Sushant Kamble Vendor Homepage: https://www.sourcecodester.com/php/14185/online-clothing-store.html Software Link:...

Online Clothing Store 1.0 - Persistent Cross-Site Scripting

Exploit Title: Online Clothing Store 1.0 - Persistent Cross-Site Scripting Date: 2020-05-05 Exploit Author: Sushant Kamble Vendor Homepage: https://www.sourcecodester.com/php/14185/online-clothing-store.html Software Link:...

Crosss-Site Scripting (XSS)

wordpress is vulnerable to cross-site scripting XSS. The stats method of class-wp-object-cache.php does not sanitize the user-provided data, allowing an attacker to inject malicious script to be executed when a user loads the page...

Remote Code Execution (RCE)

pixl-class is vulnerable to remote code execution RCE. The attack is possible because it uses eval function in class.js, allowing an attacker to inject malicious script and to get executed...

Cross-site Scripting (XSS)

Croogo is vulnerable to cross-site scripting XSS. The attacker can inject malicious script in the title parameter of admin/menus/menus or admin/taxonomy/vocabularies, causing the malicious script to be executed when a user visits the page...

CVE-2020-11813

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

Cross site scripting

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

CVE-2020-11813

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

Cross-Site Scripting (XSS)

squirrelmail is vulnerable to cross-site scripting. Insufficient HTML mail sanitization allows a remote attacker to send a specially-crafted HTML mail or attachment that could cause a user's Web browser to execute a malicious script in the context of the SquirrelMail session when that email or...

CVE-2020-11629

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload external linters to validate certificates, is supposed to save uploaded test certificates to the server. An attacker who has gained access to...

Cross-Site Scripting (XSS)

Opencart is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize the filename argument in the image upload section of admin panel, allowing an attacker to inject malicious script and get the script executed when a user visits the Image manager section...

Cross-site Scripting (XSS)

github.com/influxdata/influxdb is vulnerable to cross-site scripting XSS. The attack exists due to lack of validation of input value to the Write Data module, allowing an attacker to inject malicious script...

Cross-site Scripting (XSS)

gwtupload-samples is vulnerable to cross-site scripting XSS. The attack is possible because it allows the attacker to input malicious file names using the upload functionality, leading to an execution of malicious script when the filename is processed...

Cross-site Scripting (XSS)

dolibarr is vulnerable to cross-site scripting XSS. The attack exists because it does not properly HTML encoded to sanitize $SERVER"HTTPREFERER" arguments, allowing an attacker to inject and execute malicious script...

Information disclosure

A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious user obtain sensitive information...

Magento cross-site scripting vulnerability (CNVD-2020-04821)

Magento is an open source e-commerce framework. Magento suffers from a stored cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when malicious data is view...

CVE-2020-3925

A Remote Code ExecutionRCE vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts...