426 matches found
PT-2019-11091
Name of the Vulnerable Software and Affected Versions: ProjectSend versions prior to r1053 Description: A CSV Injection issue was discovered, affecting users who import data into Microsoft Excel. Recommendations: For versions prior to r1053, update to version r1053 or later to resolve the issue...
PT-2019-11092
Name of the Vulnerable Software and Affected Versions: ProjectSend versions prior to r1053 Description: An issue exists where XSS is present in the Name field on the My Account page, allowing for potential exploitation. Recommendations: For versions prior to r1053, update to version r1053 or late...
CVE-2018-7201: Improper Neutralization of Formula Elements in a CSV File
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
Code injection
ProjectSend before r1070 writes user passwords to the server logs...
Cross site scripting
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11492
ProjectSend before r1070 writes user passwords to the server logs...
CVE-2019-11492
ProjectSend before r1070 writes user passwords to the server logs...
CVE-2019-11533
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11533
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11533
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11533
CVE-2019-11533 affects ProjectSend prior to r1070, with a cross-site scripting (XSS) vulnerability that could allow remote attackers to inject arbitrary script/HTML. The issue stems from insufficient input sanitization in the affected component, enabling client-side script execution in the contex...
CVE-2019-11492
ProjectSend before r1070 writes user passwords to the server logs...
CVE-2019-11492
CVE-2019-11492 affects ProjectSend before release r1070, where user passwords are written to server logs. This creates exposure of credentials via log data. According to NVD, the CVSS metrics indicate a network-accessible issue with low attack complexity and a medium (CVSS2) to high (CVSS3) base ...
PT-2019-12358
Name of the Vulnerable Software and Affected Versions ProjectSend versions prior to r1070 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to r1070, update to version r1070 or later to resolve the issue...
PT-2019-12333
Name of the Vulnerable Software and Affected Versions ProjectSend versions prior to r1070 Description The issue allows user passwords to be written to the server logs. Recommendations For versions prior to r1070, update to version r1070 or later to resolve the issue...
CVE-2019-11533: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11492: Insertion of Sensitive Information into Log File
ProjectSend before r1070 writes user passwords to the server logs...
CVE-2019-11378
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...
CVE-2019-11378
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...
Directory traversal
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...