UBUNTU-CVE-2019-18210

Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users Teacher and above to inject JavaScript into the session of another user e.g., enrolled student or site administrator via the introeditortext parameter. NOTE: the discoverer and vendor disagree on whether Mood...

SUSE SLED15 / SLES15 Security Update : rubygem-rack (SUSE-SU-2020:0359-1)

This update for rubygem-rack to version 2.0.8 fixes the following issues : CVE-2018-16471: Fixed a cross-site scripting XSS flaw via the scheme method on Rack::Request bsc1116600. CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability bsc1159548. Note that Tenable...

SUSE-SU-2020:0359-1 Security update for rubygem-rack

This update for rubygem-rack to version 2.0.8 fixes the following issues: - CVE-2018-16471: Fixed a cross-site scripting XSS flaw via the scheme method on Rack::Request bsc1116600. - CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability bsc1159548...

CVE-2014-10399

The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...

IceWarp Webmail Server color Cross-Site Scripting Vulnerability

IceWarp Webmail Server is a WEB mail server. IceWarp Webmail Server color handling suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used to gain access to sensitive information or hijack...

Kronos WebTA /ApplicationBanner Stored Cross-Site Scripting Vulnerability

Kronos WebTA is an attendance system. A stored cross-site scripting vulnerability exists in Kronos WebTA /ApplicationBanner, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack a user session when malicio...

Magento cross-site scripting vulnerability (CNVD-2020-04821)

Magento is an open source e-commerce framework. Magento suffers from a stored cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when malicious data is view...

Joomla! com_actionlogs Cross-Site Scripting Vulnerability

Joomla! is a content management application. A cross-site scripting vulnerability exists in Joomla! comactionlogs, which can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when malicious data is...

Cisco Small Business Smart and Managed Switches WEB Interface Cross-Site Scripting Vulnerability

Cisco Small Business Smart and Managed Switches is a switch solution. Cross-site scripting exists in the Cisco Small Business Smart and Managed Switches WEB interface, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be used to obtain sensitive...

Kronos WebTA "com.threeis.webta.H261configMenu" servlet cross-site scripting vulnerability

Kronos WebTA is an attendance system. A cross-site scripting vulnerability exists in the Kronos WebTA "com.threeis.webta.H261configMenu" servlet, which can be exploited by an attacker to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack a...

Junos OS: Cross-Site Scripting (XSS) in J-Web (JSA10986)

According to its self-reported version number, the remote Juniper Junos device is affected by a cross-site scripting XSS vulnerability in J-Web due to insufficient XSS protection. An unauthenticated, remote attacker can exploit this, via injecting web script or HTML to hijack the target user's...

CVE-2020-1607

Insufficient Cross-Site Scripting XSS protection in J-Web may potentially allow a remote attacker to inject web script or HTML, hijack the target user's J-Web session and perform administrative actions on the Junos device as the targeted user. This issue affects Juniper Networks Junos OS 12.3...

Cross site scripting

Insufficient Cross-Site Scripting XSS protection in J-Web may potentially allow a remote attacker to inject web script or HTML, hijack the target user's J-Web session and perform administrative actions on the Junos device as the targeted user. This issue affects Juniper Networks Junos OS 12.3...

Billion Smart Energy Router SG600R2 DHCP Lease Status Form Cross-Site Scripting Vulnerability

The Billion Smart Energy Router SG600R2 is a router device. A cross-site scripting vulnerability exists in the Billion Smart Energy Router SG600R2 DHCP lease status form, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain...

CityBook < 2.3.4 - Multiple Vulnerabilities

Multiple vulnerabilities was discovered in the 'CityBook - Directory & Listing WordPress Theme', tested version — v2.3.3: - Unauthenticated Reflected XSS - Authenticated Persistent XSS - IDOR Edit WPScanTeam: December 27h, 2019 - Envato Contacted January 6th, 2020 - Envato Investigating January...

X (Formerly Twitter): Bypass Password Authentication for updating email and phone number - Security Vulnerability

Summary: Additional requirement for authentication is an extra layer of security for a person's Twitter account. Instead of only entering the password at the time of log in, twitter further Introduces additional layer of security by prompting users to enter their password before attempting to...

ASTPP VoIP 4.0.1 Remote Code Execution

Exploit Title: ASTPP VoIP 4.0.1 - Remote Code Execution Date: 2019-11-18 Exploit Author: Fabien AUNAY Vendor Homepage: https://www.astppbilling.org/ Software Link: https://github.com/iNextrix/ASTPP/tree/v4.0.1 Version: 4.0.1 vendor default setup script Tested on: Debian 9 - CentOS 7 CVE : - ASTPP...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2020-14085)

Open-Xchange AppSuite is a set of Web-based cloud desktop environments from the US-based Open-Xchange. Open-Xchange AppSuite suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2020-13687)

Open-Xchange AppSuite is a set of Web-based cloud desktop environments from the US-based Open-Xchange. Open-Xchange AppSuite suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive...

FreeBSD : rack -- information leak / session hijack vulnerability (66e4dc99-28b3-11ea-8dde-08002728f74c)

National Vulnerability Database : There's a possible information leak / session hijack vulnerability in Rack RubyGem rack. This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids ar...