Cross site scripting

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via title of an order when configuring sales payment methods for a store...

CVE-2019-16330

In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...

CVE-2019-16330

In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...

CVE-2019-16330

In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...

CVE-2019-16330

CVE-2019-16330 affects NCH Express Accounts Accounting v7.02, with a persistent XSS in Invoices/Sales Orders/Items/Customers/Quotes input fields. An authenticated unprivileged user can modify these fields to inject arbitrary JavaScript, enabling client-side script execution. Connected documents c...

Unspecified Vulnerability in Oracle Hospitality Reporting and Analytics (CNVD-2019-36657)

Oracle Hospitality Reporting and Analytics is a web-based application that centralizes point-of-sale POS data, provides operational and analytical insights into business operations, and improves efficiencies by delivering information to all roles within an organization. An unspecified vulnerabili...

LabCollector SQL Injection

SQL Injection vulnerability in LabCollector Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

New Comic Videos Take CISO/Security Vendor Relationship to the Extreme

Today's CISOs operate in an overly intensive environment. As the ones who are tasked with the unenviable accountability for failed protection and successful breaches, they must relentlessly strive to improve their defense lines with workforce education, training their security teams and last but...

E-commerce: Bad bots are ready for the holidays. Are you?

The busiest time for online retailers is almost upon us—the holiday season. Each business is looking at ways to take advantage of cyber week when a significant portion of annual sales are made. At this time, preparation is well underway for Black Friday and Cyber Monday promotions. But another...

SQL Injection Vulnerability in Huaxia ERP System

Huaxia ERP based on the SpringBoot framework , SaaS model , aspires to provide small and medium-sized enterprises with open source good ERP software , currently focusing on sales and inventory + financial functions . Huaxia ERP system SQL injection vulnerability , attackers can use the...

XSS Vulnerability in Huaxia ERP System

Huaxia ERP based on the SpringBoot framework , SaaS model , aspires to provide small and medium-sized enterprises with open source good ERP software , currently focusing on sales and inventory + financial functions . Huaxia ERP system has an XSS vulnerability that can be exploited by attackers to...

WordPress iThemes Exchange Easy US Sales Taxes Add-on Plugin Cross-Site Scripting Vulnerability

iThemes Exchange for WordPress is a plugin for creating e-commerce websites using the WordPress content management system. easy US Sales Taxes Add-on is one of the sales tax calculation plugins. A cross-site scripting vulnerability exists in the WordPress iThemes Exchange Easy US Sales Taxes Add-...

CVE-2015-9369

Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9367

Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via addqueryarg and removequeryarg...

Design/Logic Flaw

Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9369

CVE-2015-9369 affects the WordPress plugin Easy US Sales Taxes Add-on for iThemes Exchange (before 1.1.0). The vulnerability is an XSS flaw triggered via the functions add_query_arg() and remove_query_arg(), enabling attacker-controlled client-side code execution in affected contexts. The root ca...

CVE-2015-9367

The CVE-2015-9367 entry concerns the WordPress ecosystem: the Easy Canadian Sales Taxes Add-on for iThemes Exchange is vulnerable to cross‑site scripting (XSS) through add_query_arg()/remove_query_arg() in versions before 1.1.0. The underlying issue is improper handling of query parameters that c...

Pulse Connect Secure File Disclosure

File disclosure vulnerability in Pulse Connect Secure SSL VPN Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Fortinet FortiGate SSL VPN File Disclosure

File disclosure vulnerability in Fortinet FortiGate SSL VPN fgtlang lang parameter Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

iNSYNQ Ransom Attack Began With Phishing Email

A ransomware outbreak that hit QuickBooks cloud hosting firm iNSYNQ in mid-July appears to have started with an email phishing attack that snared an employee working in sales for the company, KrebsOnSecurity has learned. It also looks like the intruders spent roughly ten days rooting around...