7278 matches found
Langfang Extreme Networks Technology Co. Extreme CMS has unauthorized access vulnerability
Extreme CMS is an open source PHPCMS web content management system. Ltd. Extreme CMS has an unauthorized access vulnerability that can be exploited by attackers to obtain information about other users...
CVE-2020-15092
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Mos...
CVE-2020-15092 Stored XSS in TimelineJS3
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Mos...
Savsoft Quiz 5 - Persistent Cross-Site Scripting
Exploit Title: Savsoft Quiz 5 - Persistent Cross-Site Scripting Date: 2020-07-09 Exploit Author: Ogulcan Unverenth3d1gger Vendor Homepage: https://savsoftquiz.com/ Software Link: https://github.com/savsofts/savsoftquizv5.git Version: 5.0 Tested on: Kali Linux ---Vulnerable Source Code---- functio...
InnoGames: Stored XSS on recruit.innogames.de
Summary: When applying for a Supporter/Moderator job at recruit.innogames.de the drop-down field "Position" is vulnerable to a stored XSS as the content is not validated. Description: Steps To Reproduce: 1. Visit https://recruit.innogames.de/staemme/de/index/page/show/apply 2. Fill out all requir...
DuckDuckGo collecting user browsing data without consent (Updated)
By Sudais Asif An ethical hacker on Twitter revealed how DuckDuckGo intentionally... This is a post from HackRead.com Read the original post: DuckDuckGo collecting user browsing data without consent Updated...
Facebook exposed user data to thousands of app developers
By Zara Khan Facebook 'Privacy Matters' reveals 5000 app developers accessed user data. This is a post from HackRead.com Read the original post: Facebook exposed user data to thousands of app developers...
CVE-2020-5905
In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network WCCP page, the system does not sanitize all user-provided data before display...
CVE-2020-5905
In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network WCCP page, the system does not sanitize all user-provided data before display...
CVE-2020-5905
Summary of CVE-2020-5905: In BIG-IP, the Configuration utility (TMUI) on the Network > WCCP page fails to sanitize all user-provided data before display, enabling an XSS-style attack when accessed by an authenticated administrator. Affected versions are BIG-IP 11.6.1–11.6.5.2 (per F5 advisory)...
CVE-2019-4706
CVE-2019-4706 affects IBM Security Identity Manager Virtual Appliance versions 7.0.2 and 7.0.1. The vulnerability is that ISIM VA writes information to log files that can be of a sensitive nature, potentially exposing sensitive user information or guiding an attacker. IBM’s bulletin confirms the ...
Apache Archiva < 2.2.5 LDAP Injection Vulnerability
Apache Archiva is prone to an LDAP injection vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:archiva"; if...
Web skimming with Google Analytics
Web skimming is a common class of attacks generally aimed at online shoppers. The principle is quite simple: malicious code is injected into the compromised site, which collects and sends user-entered data to a cybercriminal resource. If the attack is successful, the cybercriminals gain access to...
The vulnerability of Panasonic Video Insight VMS software arises from insufficient verification of data provided by users. This allows a hacker to execute arbitrary code.
The vulnerability of Panasonic Video Insight VMS software lies in the insufficient verification of data provided by users. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted malicious request...
Beijing Liangjing Zhicheng Technology Co., Ltd.'s Liangjing Mall Online Shop Shopping System Has Logic Flaws and Vulnerabilities
Liangjing Mall online store shopping system is a set of different types of goods, flexible multi-functional online store system, three-tier distribution PC + mobile + micro-site. Beijing Liangjing Zhicheng Technology Co., Ltd. Liangjing Mall online shopping system has a logic flaw vulnerability...
Unauthorized Access Vulnerability in the National Student Management Information System for Secondary Vocational Schools
National Secondary Vocational School Student Management Information System is a student information management system. An unauthorized access vulnerability exists in the National Secondary Vocational School Student Management Information System, which can be exploited by an attacker to obtain use...
Open-Xchange: XSS on opening malicious OpenOffice presentation document
Title Opening a malicious OpenOffice presentation document may lead to cross site scripting XSS attacks Description When generating HTML content for drawings present in odp file, a div is generated by Drawing.java. The attribute target of this div is directly constructed from the field target...
Cisco Application Services Engine Access Control Error Vulnerability
Cisco Application Services Engine is the United States Cisco Cisco company's set of common platform for the deployment of Cisco data center applications. The keystore in Cisco Application Services Engine versions prior to 1.1.2.20 is vulnerable to an Access Control Error vulnerability that stems...
New users can read all Nextcloud Deck data from previous user with same username (NC-SA-2021-007)
A logic error in Nextcloud Deck 1.0.1 allowed new users with a duplicate user identifier to use deck data of a previous deleted user...