CVE-2019-18663

A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the userid parameter...

CVE-2019-17551

In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:richtexteditornotetext parameter in the Notes section. Although versions...

CVE-2019-17551

CVE-2019-17551 affects Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5. An attacker can send an authenticated POST to /WFS/agreementView.faces to trigger a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text field in the Notes section. The issue is tied to the WYSIW...

ClipSoft REXPERT Arbitrary File Creation Vulnerability

ClipSoft REXPERT is a report generation program from ClipSoft Korea. An arbitrary file creation vulnerability exists in ClipSoft REXPERT. An attacker can exploit this vulnerability to create arbitrary files via a POST request...

CVE-2019-17324

ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ../ characters. This could lead to create malicious HTML file, because they can inject a content with crafted template. User interaction is required to exploit this vulnerability ...

CVE-2019-17322

ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable file that is written to in the arbitrary directory. User interaction is required to exploit this vulnerability in that...

CVE-2019-17322

ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable file that is written to in the arbitrary directory. User interaction is required to exploit this vulnerability in that...

Design/Logic Flaw

ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable file that is written to in the arbitrary directory. User interaction is required to exploit this vulnerability in that...

CVE-2019-17324

ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ../ characters. This could lead to create malicious HTML file, because they can inject a content with crafted template. User interaction is required to exploit this vulnerability ...

CVE-2019-17322

ClipSoft REXPERT 1.0.0.527 and earlier is vulnerable to arbitrary file creation via a POST request where the file path is supplied as a parameter. An attacker could cause writing of an executable file to an arbitrary directory. Exploitation requires user interaction: the target must visit a malic...

CVE-2019-17322

ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable file that is written to in the arbitrary directory. User interaction is required to exploit this vulnerability in that...

Apache Solr Remote Code Execution via Velocity Template

This module exploits a vulnerability in Apache Solr use exploit/multi/http/solr/velocityrce msf undefinedvelocityrce show actions ...actions... msf undefinedvelocityrce set ACTION msf undefinedvelocityrce show options ...show and set options... msf undefinedvelocityrce run This module requires...

CVE-2019-14276

WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...

CVE-2019-14276

WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...

Design/Logic Flaw

WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...

CVE-2019-14276

WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...

CVE-2019-14276

The CVE-2019-14276 issue affects WUSTL XNAT 1.7.5.3, where XXE attacks are possible via the POST request body. Connected sources confirm the vulnerability is tied to XXE in XNAT 1.7.5.3 and recommend updating to a newer version that contains a fix. The NVD has documented scores (CVSS v2 and v3.1)...

CVE-2019-13392

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

Cross site scripting

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

EUVD-2019-4886

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...