cloudforms: XSS in self-service UI snapshot feature

A flaw was found in CloudForms in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP Content Securi...

Progress Sitefinity Cross-Site Scripting Vulnerability (CNVD-2018-05684)

Progress Sitefinity is an open source platform for building corporate websites and intranets. A cross-site scripting vulnerability exists in Progress Sitefinity version 9.1. The vulnerability can be exploited by remote attackers to inject malicious JavaScript code via the Last name, First name, a...

WordPress Bookly Lite 13.2 Cross Site Scripting

In January I found a stored XSS in Bookly WP Plugin 10,000+ download for Lite version on official WordPress plugin site and 18,000+ for Pro version on CodeCanyon. Link of Bookly stored XSS proof-of-concept: https://www.gubello.me/blog/bookly-blind-stored-xss/ During the booking phase, an...

Dell SonicWALL Global Management System Cross-Site Scripting Vulnerability

The Dell SonicWall Global Management System GMS is a global management system from Dell, USA. The system enables rapid deployment and centralized management of Dell SonicWALL firewall, anti-spam, backup and recovery, and secure remote access solutions. A cross-site scripting vulnerability exists ...

NewsBee Cross-Site Scripting Vulnerability

NewsBee is a CMS Content Management System for news websites. A security vulnerability exists in NewsBee. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML via the Company Name field...

Cross site scripting

NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php...

Hiro: Missing restriction on string size of Full Name at browser.blockstack.org

Hi there Vulnerability Title: During my regular testing, I have found that there was no restriction on the amount of text that can be inserted into a user's Full name field. Security Impact: When the text size was large enough the service resulting in a momentary outage in our non-production...

User Login And Management PHP Script 1.0 Cross Site Scripting

Exploit Title: User Login and Management PHP Script - xss Google Dork: N/A Date: 2018/06/01 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: https://www.codester.com/ajay138 Software Buy: https://codecanyon.net/item/user-login-register-and-user-management/9617985...

QuickApps CMS Cross-Site Scripting Vulnerability

QuickApps CMS is a PHP-based, open source, modular content management system. A cross-site scripting vulnerability exists in the user's real name field in QuickApps CMS version 2.0.0. A remote attacker can exploit this vulnerability to cause a denial of service and perform unauthorized operations...

CVE-2017-1000495

QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthorised actions with an administrator user's account...

CVE-2017-12812

PHPJabbers Night Club Booking Software has stored XSS in the name parameter in the reservations tab...

CVE-2017-17843

An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and ...

UBUNTU-CVE-2017-16908

In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed...

CVE-2017-16908

The CVE-2017-16908 entry concerns Horde Groupware 5.2.19, where an XSS vulnerability in the Resource Name field can be exploited to enable remote code execution after compromising an administrator account, by bypassing the CVE-2015-7984 CSRF protection mechanism. Affected product/component: Horde...

Easy MPEG/AVI/DIVX/WMV/RM To DVD Buffer Overflow Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: Easy MPEG/AVI/DIVX/WMV/RM to DVD - 'Enter User Name' Field Buffer Overflow SEH Date: 05-10-2017 Exploit Author: Venkat Rajgor Vendor Homepage: http://www.divxtodvd.net/ Software Link:...

GHSA-Q44R-F2HM-V76V Pupper does not properly restrict characters in Common Name field of Certificate Signing Request

lib/puppet/ssl/certificateauthority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request CSR, which makes it easier for user-assisted remote attackers to trick...

CVE-2017-15287

There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bouquets" field, or the file parameter to the /file URI...

Flyspray stored cross-site scripting vulnerability (CNVD-2017-30492)

Flyspray is a lightweight, web-based, bug tracking system written in PHP to assist in software development and project management. Flyspray suffers from a stored cross-site scripting vulnerability that allows authenticated users to gain administrator privileges by injecting JavaScript into...

DiskBoss Enterprise 8.4.16 - Local Buffer Overflow (PoC)

!/usr/bin/python ======================================================================================================================== Exploit Author: Touhid M.Shaikh Exploit Title: DiskBoss Enterprise v8.4.16 Local Buffer OverflowPoC Date: 28-09-2017 Website: www.touhidshaikh.com Vulnerable...

Cross-site Scripting

dolibarr is vulnerable to cross-site scripting attacks. The attack exists because it does not correctly filter the "url" field through the external calendar or 2 the bank name field in the "import external calendar" page, allowing the attacker to inject arbitrary script through them...