CVE-2020-12101

The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by manipulating an id field in the POST request for altering an address...

ChemInv 1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: ChemInv - Authenticated Persistent Cross-Site Scripting Exploit Author: Bobby Cooke Software Link: https://github.com/tmorrell/cheminv Software Info: "Cheminv is a web-based chemical inventory system. This responsive database...

Online Scheduling System 1.0 Authentication Bypass

Exploit Title: Online Scheduling System 1.0 - Authentication Bypass Exploit Author: Bobby Cooke Date: 2020-04-30 Vendor Homepage: https://www.sourcecodester.com/php/14168/online-scheduling-system.html Software Link:...

CVE-2020-12132

Fifthplay S.A.M.I before 2019.3HP2 allows unauthenticated stored XSS via a POST request...

CVE-2020-12132

Fifthplay S.A.M.I before 2019.3HP2 allows unauthenticated stored XSS via a POST request...

Cross site scripting

Fifthplay S.A.M.I before 2019.3HP2 allows unauthenticated stored XSS via a POST request...

CVE-2020-12132

Fifthplay S.A.M.I before 2019.3HP2 allows unauthenticated stored XSS via a POST request...

CVE-2020-12132

The CVE-2020-12132 entry describes an unauthenticated stored XSS in Fifthplay S.A.M.I (Service And Management Interface) prior to 2019.3_HP2. A POST request can inject HTML/JS that is reflected to users, enabling client-side script execution in affected sessions. Affected platforms include Platfo...

CVE-2020-12059

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception...

Null pointer dereference

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception...

REST API for Add user to group returns error 400 instead of 404 when the user does not exist

h3. Issue Summary REST API for Add user to group returns error 400 instead of 404 when the user does not exist. According to the documentation of JIRA 8.5.3|https://docs.atlassian.com/software/jira/docs/api/REST/8.5.3/api/2/group-addUserToGroup when the user or group does not exist, an error 404...

Shopify: Account takeover intercepting magic link for Arrive app

Summary The "magic link" used for login by Arrive app uses Branch.io to pass the login token via deeplink to the app. But the URL contained in the link app.link domain is not verified so it can be intercepted by a malicious app at takeover the account. Description When trying to login with Arrive...

Prestashop 1.7.6.4 XSS / CSRF / Remote Code Execution

Prestashop | stazot.com Last Modified: 2020-04-11 Vendor : https://www.prestashop.com/ Version : = 1.7.6.4 Tested on : 1.7.6.4 -- Table of Contents 00 - Introduction 01 - Exploit 02 - Cross-Site Request Forgery CSRF 02.1 - Exploitation 03 - Stored Cross-Site Scripting 03.1 - Exploitation 04 -...

The vulnerability of the Util_urlDecode method implementation in the Monit management and monitoring utilities allows a perpetrator to trigger a service failure.

The vulnerability of the UtilurlDecode method in the Monit utility for managing and monitoring processes, programs, files, and directories is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failur...

WSO2 3.1.0 - Persistent Cross-Site Scripting

Title: WSO2 3.1.0 - Persistent Cross-Site Scripting Date: 2020-04-13 Author: raki ben hamouda Vendor: https://apim.docs.wso2.com Softwrare link: https://apim.docs.wso2.com/en/latest/ CVE: N/A Advisory: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0700 Technical Details &...

Webtateas 2.0 - Arbitrary File Read

Exploit Title: Webtateas 2.0 - Arbitrary File Read Date: 2020-04-12 Exploit Author: China Banking and Insurance Information Technology Management Co.,Ltd. Vendor Homepage: http://webtareas.sourceforge.net/general/home.php Software Link: http://webtareas.sourceforge.net/general/home.php Version:...

Webtateas 2.0 - Arbitrary File Read Vulnerability

Exploit for php platform in category web applications Exploit Title: Webtateas 2.0 - Arbitrary File Read Exploit Author: China Banking and Insurance Information Technology Management Co.,Ltd. Vendor Homepage: http://webtareas.sourceforge.net/general/home.php Software Link:...

Denial Of Service (DoS)

php is vulnerable to denial of service DoS. The vulnerability exists as it was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large...

Denial Of Service (DoS)

jbossws-common is vulnerable to denial of service DoS. The vulnerability exists as it was found that JBoss Web Services Native did not properly protect against recursive entity resolution when processing Document Type Definitions DTD. A remote attacker could exploit this flaw by sending a...

Hardcoded credentials

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leveraged to send emails from a customer trusted email address...