10680 matches found
Cross site request forgery (csrf)
An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request...
Design/Logic Flaw
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
CVE-2018-18431
DESTOON B2B 7.0 contains a cross-site scripting (XSS) vulnerability exposed via text boxes when visiting admin.php?moduleid=2&action=add. The CVE entry and CNVD/NVD variants describe the same issue, with no explicit details on affected build flavors beyond version 7.0 and the vulnerable input poi...
CVE-2018-18430
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
CVE-2018-18430
DESTOON B2B 7.0 contains an XSS vulnerability in admin/setting.inc.php reachable via the first text box to the admin.php URI. The issue is publicly documented across multiple sources (NVD entry CVE-2018-18430; CNVD/CVELIST entries) and is reflected with a CVSS profile indicating a MEDIUM base sev...
CVE-2018-18432
Summary: DESTOON B2B 7.0 is affected by a CSRF vulnerability that can be exploited via the admin.php URI with an action=add request. Multiple sources (NVD entry CVE-2018-18432 and CNVD/NVD references) confirm a CSRF flaw in DESTOON B2B 7.0. The CVSS metrics indicate a network-based, high-severity...
Ekushey Project Manager CRM 3.1 Cross Site Scripting Vulnerability
Ekushey Project Manager CRM version 3.1 suffers from a persistent cross site scripting vulnerability. Exploit Title: Ekushey Project Manager CRM 3.1 - Cross-site Scripting Exploit Author: Ismail Tasdelen Vendor Homepage: http://creativeitem.com/ Software Link : http://creativeitem.com/demo/ekushe...
Microsoft Visual Studio Code URL Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Visual Studio Code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2018-18382
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" aka user/edit-profile action...
The vulnerability of the web interface of the EMG12 Ethernet Modbus Gateway allows a intruder to execute arbitrary code.
The vulnerability of the web interface of the EMG12 Ethernet Modbus Gateway arises from errors in the authentication mechanism. Operating the system allows a malicious actor to bypass the authentication mechanism and execute arbitrary code using a specially crafted URI...
CVE-2018-18316
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI...
CVE-2018-18317
DESHANG DSCMS 1.1 contains a cross-site request forgery (CSRF) vulnerability exposed via the public/index.php/admin/admin/add.html URI. A remote attacker can perform unauthorized operations through this endpoint. The CVE CVE-2018-18317 is documented in NVD with CVSSv2 base score 6.8 (Partial conf...
Microsoft Edge browser-explosive high-risk vulnerabilities, controlled by computer-executable any command-vulnerability warning-the black bar safety net
10 on 12 May, security researchers released a Windows Shell REC（ CVE-2018-8495, the vulnerability proof of concept code, the affected software for Windows 10 built-in Microsoft Edge, the attacker can use the code through the Microsoft Edge browser on the remote computer to run malicious code. It ...
XSS in labels widget
If a user can control the content returned by code/rest/dashboards/1.0//gadget/10100/prefscode they can update the searchUrl field to execute a stored XSS. Here are the steps to reproduce: Upload an attachment to a ticket with the following content:...
XSS in labels widget
If a user can control the content returned by code/rest/dashboards/1.0//gadget/10100/prefscode they can update the searchUrl field to execute a stored XSS. Here are the steps to reproduce: Upload an attachment to a ticket with the following content:...
CVE-2018-18258
An issue was discovered in BageCMS 3.1.3. The attacker can execute arbitrary PHP code on the web server and can read any file on the web server via an index.php?r=admini/template/updateTpl&filename= URI...
Microsoft SQL Server Management Studio 17.9 - .xmla XML External Entity Injection
Microsoft SQL Server Management Studio 17.9 - .xmla XML External Entity Injection Exploit Title: Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection Date: 2018-10-10 Author: John Page aka hyp3rlinx Website: hyp3rlinx.altervista.org Venodor: www.microsoft.com...
Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection
Exploit Title: Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection Date: 2018-10-10 Author: John Page aka hyp3rlinx Website: hyp3rlinx.altervista.org Venodor: www.microsoft.com Software: SQL Server Management Studio 17.9 and SQL Server Management Studio 18.0 Preview 4 CVE:...