338 matches found
CVE-2018-7202
An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page...
CVE-2018-7202
An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page...
CVE-2018-7202
CVE-2018-7202 affects ProjectSend prior to r1053, where an XSS flaw exists in the Name field on the My Account page. Root cause: insufficient input validation/escaping in that field, enabling injection of client-side scripts. Impact is cross-site scripting affecting users handling their My Accoun...
CVE-2018-7202
An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page...
ProjectSend CVS Injection Vulnerability
rojectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A CVS injection vulnerability exists in versions prior to ProjectSend r1053 that affects victims who import data into Microsoft Excel...
CVE-2019-11533
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
Cross site scripting
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11492
ProjectSend before r1070 writes user passwords to the server logs...
CVE-2019-11533
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11492
ProjectSend before r1070 writes user passwords to the server logs...
Code injection
ProjectSend before r1070 writes user passwords to the server logs...
CVE-2019-11533
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11533
CVE-2019-11533 affects ProjectSend prior to r1070, with a cross-site scripting (XSS) vulnerability that could allow remote attackers to inject arbitrary script/HTML. The issue stems from insufficient input sanitization in the affected component, enabling client-side script execution in the contex...
CVE-2019-11492
ProjectSend before r1070 writes user passwords to the server logs...
CVE-2019-11492
CVE-2019-11492 affects ProjectSend before release r1070, where user passwords are written to server logs. This creates exposure of credentials via log data. According to NVD, the CVSS metrics indicate a network-accessible issue with low attack complexity and a medium (CVSS2) to high (CVSS3) base ...
CVE-2019-11378
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...
CVE-2019-11378
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...
Directory traversal
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...
CVE-2019-11378
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...
CVE-2019-11378
ProjectSend (revision r1053) is affected by CVE-2019-11378 through the upload-process-form.php endpoint, where finished_files[]=../ enables directory traversal. This allows attackers to read arbitrary files and potentially access the supporting database, delete files, leak user passwords, or exec...