CVE-2018-18417: Improper Neutralization of Input During Web Page Generation

In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...

nc-cms cross-site scripting vulnerability (CNVD-2018-21238 )

nc-cms is a PHP-based embeddable lightweight CMS Content Management System. A cross-site scripting vulnerability exists in the index.php?action=edithtml page in nc-cms 2017-03-10 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the...

CVE-2018-18361

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...

CVE-2018-18361

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...

CVE-2018-18361: Improper Neutralization of Input During Web Page Generation

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...

PT-2018-14417

Name of the Vulnerable Software and Affected Versions nc-cms versions prior to 2017-03-10 Description An issue was discovered that allows XSS via the name parameter in the "index.php?action=edit html" endpoint. This is demonstrated by a value beginning with 'home content' and containing a crafted...

RICOH MP 2001 Cross-Site Scripting Vulnerability

The RICOH MP 2001 is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address add area of the RICOH MP 2001, which arises from the program failing to properly validate user-submitted input. An attacker can exploit the vulnerability by sending the...

ManageEngine AssetExplorer 6.2.0 Cross Site Scripting Vulnerability

In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter. Exploit Title: ManageEngine AssetExplorer 6.2.0 - Stored XSS Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardwa...

PT-2018-18837

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The issue allows an attacker to execute arbitrary commands as the root user by crafting a command injection payload using backtick characters in the name...

CVE-2018-9076: Improper Neutralization of Special Elements used in an OS Command

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "" characters in the name parameter. As a result, arbitrary commands may be executed as the root user. The attack...

Subsonic cross-site scripting vulnerability (CNVD-2018-19874)

Subsonic is a media file hosting platform. The 'namex', 'streamUrlx', and 'homepageUrlx' in the Subsonic version 6.1.1 A cross-site scripting vulnerability exists in the 'namex', 'streamUrlx', and 'homepageUrlx' parameters, which can be exploited by a remote attacker by sending 'namex',...

CVE-2018-14689

An issue was discovered in Subsonic 6.1.1. The transcoding settings are affected by five stored cross-site scripting vulnerabilities in the namex, sourceformatsx, targetFormatx, step1x, and step2x parameters where x is an integer to transcodingSettings.view that could be used to steal session...

CVE-2018-16953

The AjaxView::DisplayResponse function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting XSS. User input from the name parameter is unsafely reflected in the server response. NOTE: this CVE is assigned by MITRE and isn't...

Cross site scripting

The AjaxView::DisplayResponse function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting XSS. User input from the name parameter is unsafely reflected in the server response. NOTE: this CVE is assigned by MITRE and isn't...

PT-2018-13792

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Interaction Portal version 10.3.3 Description The issue concerns a reflected cross-site scripting XSS problem. Specifically, user input from the name parameter is unsafely reflected in the server response by the...

Oracle WebCenter Interaction Cross-Site Scripting Vulnerability (CNVD-2018-19487)

Oracle WebCenter Interaction is Oracle's suite for creating enterprise portals, collaborative communities, portfolio applications, and social applications.Oracle WebCenter Interaction Portal is one of the management interfaces. A cross-site scripting vulnerability exists in the...

CVE-2018-16953: Improper Neutralization of Input During Web Page Generation

The AjaxView::DisplayResponse function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting XSS. User input from the name parameter is unsafely reflected in the server response. NOTE: this CVE is assigned by MITRE and isn't...

PT-2018-13052

Name of the Vulnerable Software and Affected Versions KONE Group Controller KGC versions prior to 4.6.5 Description An issue allows unauthenticated Local File Inclusion and File modification through the open HTTP interface. This can be achieved by modifying the name parameter of the file endpoint...

CVE-2018-16432

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

SQL Injection Vulnerability in OpenCart

OpenCart is an open source e-commerce building system developed using PHP. The system is easy to install, powerful, simple to operate, and supports multi-language, multi-currency and multi-store. OpenCart Chinese free version v3.0 there are SQL injection vulnerabilities , the vulnerability stems...