3549 matches found
PT-2019-13826 · Woo Variation Swatches · Woo-Variation-Swatches
Name of the Vulnerable Software and Affected Versions: Woo-variation-swatches plugin version 1.0.61 Description: The issue allows for XSS via the "tab" parameter in the 'wp-admin/admin.php?page=woo-variation-swatches-settings' endpoint. Recommendations: For version 1.0.61, consider disabling acce...
PT-2019-5834
Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.10.7 osTicket versions 1.12.x prior to 1.12.1 Description An issue exists in the export spreadsheets functionality of osTicket, where CSV injection is possible due to unvalidated or unfiltered user input in the Nam...
CVE-2019-14550
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus...
CVE-2019-14550
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus...
CVE-2019-14550: Improper Neutralization of Input During Web Page Generation
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus...
PT-2019-13748
Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.9 Description The issue allows for stored XSS execution when a victim clicks on the Edit Dashboard feature on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which fires wh...
CVE-2019-14349
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...
CVE-2019-14349
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...
Cross site scripting
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...
CVE-2019-14349
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...
CVE-2019-14349: Improper Neutralization of Input During Web Page Generation
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...
CVE-2019-11693
The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. Note: this issue only occurs on Linux. Other operating systems are unaffected.. This...
CVE-2019-1010091
Removed by vendor...
CVE-2019-1010091
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab...
CVE-2019-1010091: Improper Neutralization of Input During Web Page Generation
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab...
chromium-browser: Overly permissive tab access in Extensions
Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extension to bypass restrictions on file URIs via a crafted Chrome Extension...
Discourse < 2.3.0.beta10 Multiple Vulnerabilities
Discourse is prone to multiple vulnerabilities including vulnerabilities in 3rdparty components. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...
PT-2019-19356
Name of the Vulnerable Software and Affected Versions HotelDruid versions prior to 2.3.1 Description The issue is related to SQL Injection, which can be exploited via the "numtariffa1" parameter in the "/tab tariffe.php" API endpoint. Recommendations For versions prior to 2.3.1, update to version...
PT-2019-19353
Name of the Vulnerable Software and Affected Versions Hoteldruid versions prior to 2.3.1 Description A division by zero issue was found due to the mishandling of non-numeric values in the numtariffa1 parameter of the tab tariffe.php file. This could allow an administrator to conduct a remote deni...