CVE-2019-16950

An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript...

The vulnerability of the safer_name_suffix function in the GNU Tar archive manager allows a hacker to bypass the intended security measures and write data to arbitrary files.

The vulnerability of the safernamesuffix function in the GNU Tar archive manager exists due to an incorrect restriction on the pathname to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to bypass the intended security measures and write to arbitrary...

CVE-2019-17432: Improper Neutralization of Input During Web Page Generation

An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/admin/general.config/edit CSRF vulnerability, as demonstrated by resultant XSS via the rowname parameter...

Design/Logic Flaw

DISPUTED Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to...

CVE-2019-16925

Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change th...

CVE-2019-16925

CVE-2019-16925 affects Flower 0.9.3, with an XSS vulnerability reported via the name parameter in an @app.task call. The core issue appears to be unvalidated client-side data in the Flower web interface, but multiple sources note the project author disputes the vulnerability’s validity and emphas...

PT-2019-14872 · Celery · Flower

Name of the Vulnerable Software and Affected Versions: Flower version 0.9.3 Description: The issue concerns a potential XSS via the name parameter in an @app.task call. However, the project author disputes the validity of this issue, stating that worker and task names are internal backend...

CVE-2019-16925: Improper Neutralization of Input During Web Page Generation

Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change th...

PT-2019-7755 · WordPress · Icegram

Name of the Vulnerable Software and Affected Versions: icegram plugin versions prior to 1.9.19 Description: The issue concerns a CSRF vulnerability via the option name parameter in the "wp-admin/edit.php" endpoint. This allows for potential unauthorized actions. Recommendations: For versions prio...

PT-2019-7754 · WordPress · Colorway

Name of the Vulnerable Software and Affected Versions: Colorway theme versions prior to 3.4.2 for WordPress Description: The issue concerns a Cross-Site Scripting XSS problem. It is related to the contactName parameter. There is no information provided about the estimated number of potentially...

CVE-2019-14747

DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter...

PT-2019-7023

Name of the Vulnerable Software and Affected Versions Windu CMS version 2.2 Description The issue allows for cross-site scripting XSS attacks. This can be achieved via the name parameter to 'admin/content/edit' or 'admin/content/add' API endpoints, or the username parameter to the 'admin/users'...

CVE-2013-7474: Improper Neutralization of Input During Web Page Generation

Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users...

PT-2019-13611

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.6 Description The issue is related to stored XSS due to the lack of filtration of user-supplied data in the Create Task feature. An attacker can modify the name parameter to contain JavaScript code, potentially...

PT-2019-3124

Name of the Vulnerable Software and Affected Versions ТрастМед:Лекарственное обеспечение affected versions not specified Description The issue is related to the lack of protection for the web page structure, allowing a remote attacker to perform cross-site scripting attacks by manipulating the na...

PT-2019-12900

Name of the Vulnerable Software and Affected Versions Teclib News plugin for GLPI versions through 1.5.2 Description The issue allows a stored XSS attack via the name parameter in the $ POST request. Recommendations For versions through 1.5.2, as a temporary workaround, consider validating and...

PT-2019-12511 · Synology · Synology Moments

Name of the Vulnerable Software and Affected Versions: Synology Moments versions prior to 1.3.0-0691 Description: The issue concerns a relative path traversal vulnerability. It allows remote authenticated users to upload arbitrary files via the name parameter. Recommendations: For versions prior ...

CVE-2019-11826: Relative Path Traversal

Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary files via the name parameter...

PT-2019-9392

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.5.4 Description A cross-site scripting issue exists via the name parameter within the Account Information page, allowing an attacker to execute arbitrary JavaScript code within the auto login admin management page...

CVE-2018-17146: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page...