Cross site scripting

A remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1...

CVE-2018-12483

OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the content of the ipdiscoveranalyser rzo GET parameter is concatenated to a string used in an exec call in the PHP code. Authentication is needed in order to exploit this vulnerabili...

Web Remote Viewer Default Credentials (HTTP)

Web Remote Viewer has the default username SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

ASUS HG100 Command Execution Vulnerability

ASUS HG100 is a home smart monitoring device from ASUS. A command execution vulnerability exists in ASUS HG100 using firmware versions prior to 1.05.12. A remote attacker could exploit the vulnerability to execute commands...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-24614)

IBM Rational Quality Manager RQM is a collaborative, Web-based quality management solution from IBM. The program provides test planning and test evaluation management methods within the entire software development lifecycle, and the ability to share information, automation to accelerate the proje...

Google Chrome Omnibox URL Spoofing Vulnerability (CNVD-2018-18761)

Google Chrome is a web browser developed by Google, Inc. and Omnibox is a real-time search engine. A security vulnerability exists in Omnibox in versions of Google Chrome prior to 68.0.3440.75. A remote attacker can exploit the vulnerability to forge URLs with the help of a specially crafted...

Oracle MySQL Server Remote Vulnerability (CNVD-2018-13748)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which the MySQL Server component is a database server component. A security vulnerability exists in Oracle MySQL Server. An attacker can exploit the vulnerability to cause MySQL Server to hang or cras...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2018-14089)

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in WUZHI CMS version 4.1.0. A remote attacker can inject arbitrary Web script or HTML by sending the 'formcontent'...

HPESBHF03863 rev.1 - HPE Intelligent Management Center (iMC), Remote Cross-site Scripting (XSS)

Potential Security Impact: Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Intelligent Management Center iMC PLAT v7.3 E0506 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2018-7075 |...

joyplus-cms cross-site scripting vulnerability (CNVD-2018-17480)

joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A cross-site scripting vulnerability exists in...

Oracle Fusion Middleware Oracle WebLogic Server Component Remote Vulnerability (CNVD-2018-13568)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. Oracle WebLogic Server is one of the application server components for cloud and traditional...

Oracle Fusion Middleware Oracle WebLogic Server Component Remote Vulnerability (CNVD-2018-13563)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platform for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. Oracle WebLogic Server is one of the application server components for cloud and traditional...

Mobotix Webcam Default Credentials (HTTP)

The remote Mobotix Webcam is using known default credentials. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2018-2948

Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products subcomponent: Web Runtime. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOn...

Microsoft Internet Explorer Scripting Engine CVE-2018-8242 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Internet Explorer 9, 10 and 11 are...

Microsoft ChakraCore Scripting Engine CVE-2018-8298 Remote Memory Corruption Vulnerability

Description Microsoft ChakraCore is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft ChakraCore...

USN-3706-1 libjpeg-turbo vulnerabilities

It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or automated system were tricked into opening a specially crafted JPEG image, a remote attacker could cause libjpeg-turbo to crash, resulting in a denial of service, or possibly execute arbitrary cod...

CVE-2017-1248

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124628...

UBUNTU-CVE-2018-13112

getl2len in common/get.c in Tcpreplay 4.3.0 beta1 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via crafted packets, as demonstrated by tcpprep...

Nagios Fusion Cross-Site Scripting Vulnerability

Nagios Fusion is a suite of IT infrastructure visualization and monitoring solutions from the US-based Nagios Corporation. The solution supports centralized management of decentralized Nagios monitoring servers and provides a visual interface. A cross-site scripting vulnerability exists in Nagios...