4705 matches found
CVE-2018-18655
Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...
Leanote cross-site scripting vulnerability (CNVD-2018-21793)
Leanote is an open source notepad application. A cross-site scripting vulnerability exists in the Blog Basic Setting page in Leanote version 2.6.1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the title field...
Design/Logic Flaw
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page...
CVE-2018-18553
Leanote 2.6.1 is affected by a cross-site scripting (XSS) vulnerability in the Blog Basic Setting title field, exploitable via rendering of the Likes page. The issue stems from mishandling the title field during page rendering, allowing injected scripts/HTML to execute in affected contexts. Pub...
PT-2018-14512
Name of the Vulnerable Software and Affected Versions Leanote version 2.6.1 Description The issue concerns a mishandling of the title field in the Blog Basic Setting during the rendering of the "likes" page, leading to an XSS issue. Recommendations For Leanote version 2.6.1, update to a version...
CVE-2018-18553: Improper Neutralization of Input During Web Page Generation
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page...
CVE-2018-18430
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
CVE-2018-18430
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
Design/Logic Flaw
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
CVE-2018-18430
DESTOON B2B 7.0 contains an XSS vulnerability in admin/setting.inc.php reachable via the first text box to the admin.php URI. The issue is publicly documented across multiple sources (NVD entry CVE-2018-18430; CNVD/CVELIST entries) and is reflected with a CVSS profile indicating a MEDIUM base sev...
DiliCMS Cross-Site Scripting Vulnerability (CNVD-2019-17480)
DiliCMS is a rapid development content management system based on CodeIgniter. DiliCMS has a cross-site scripting vulnerability that can be exploited to inject web scripts and obtain sensitive information via the attachmenturl parameter of admin/index.php/setting/site?tab=siteattachment...
Cross site scripting
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
CVE-2018-18210
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
CVE-2018-18209
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...
CVE-2018-18210
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
PT-2018-14371
Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A security issue exists due to the presence of XSS in the attachment url parameter of the "admin/index.php/setting/site?tab=site attachment" endpoint. Recommendations For DiliCMS version 2.4.0, avoid using the...
PT-2018-14369
Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A security issue exists due to the presence of XSS in the attachment type parameter of the "admin/index.php/setting/site?tab=site attachment" endpoint. Recommendations For DiliCMS version 2.4.0, avoid using th...
Microsoft Office: Disable Opt-in Wizard on first run
This test checks the setting for policy OpenVAS Vulnerability Test $Id: officeoptinwizard.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Disable Opt-in Wizard on first run Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is...
CVE-2018-18209: Improper Neutralization of Input During Web Page Generation
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...
CVE-2018-18210: Improper Neutralization of Input During Web Page Generation
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...