Cross site scripting

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...

CVE-2020-14943

CVE-2020-14943 affects Global RADAR BSA Radar versions 1.6.7234.24750 and earlier. The vulnerability is a stored cross-site scripting (XSS) in the Update User Profile feature, exploitable via the Firstname and Lastname parameters. Public PoCs and exploits show injection of script payloads (e.g., ...

PT-2020-14079 · Global Radar · Global Radar Bsa Radar

Name of the Vulnerable Software and Affected Versions: Global RADAR BSA Radar versions 1.6.7234.24750 and earlier Description: The issue concerns stored cross-site scripting XSS via the Update User Profile feature. Specifically, the Firstname and Lastname parameters are vulnerable. Recommendation...

CVE-2020-12712

SOS JobScheduler JOE component (versions 1.12 and 1.13) stores FTP/SSH passwords using the profile name as the encryption key, enabling decryption of the plaintext password due to insecure encryption. Impact: attackers who can access the profile configuration can recover stored credentials. Root ...

CVE-2020-0116

In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2020-0116

In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Design/Logic Flaw

In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

XSS Vulnerability in jfinal cms User Profile Edit

jfinal cms is a java development of powerful information consulting website , using a simple and powerful JFinal as the web framework , template engine with beetl, database with mysql, front-end bootstrap framework. jfinal cms user profile editing XSS vulnerability , an attacker can exploit the...

Cross-Site Scripting (XSS)

tryton is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the name parameter in the User Profile...

Failed to call RPC function: Error code: 0x80131500

Challenge Backup of Remote Desktop Server VMs with Application-Aware Processing may fail with an Unknown error, error code 0x80131500. You will see error messages similar to: "Failed to call RPC function 'Vss.GetSqlInfoForLastSnapshot2': Error code: 0x80131500. Failed to invoke func...

Tryton 5.4 - Persistent Cross-Site Scripting

Exploit Title: Tryton 5.4 - Persistent Cross-Site Scripting Exploit Author: Vulnerability-Lab Date: 2020-05-13 Vendor Homepage: https://www.tryton.org/ Version: 5.4 Software Link: https://www.tryton.org/download Document Title: =============== Tryton v5.4 - Name Persistent Cross Site Vulnerabilit...

Tryton 5.4 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Tryton 5.4 - Persistent Cross-Site Scripting Vendor Homepage: https://www.tryton.org/ Version: 5.4 Software Link: https://www.tryton.org/download Document Title: =============== Tryton v5.4 - Name Persistent Cross Site...

qdPM 9.1 Arbitrary File Upload

Exploit Title: qdPM 9.1 - Arbitrary File Upload Date: 2020-05-06 Author: Besim ALTINOK Vendor Homepage: https://sourceforge.net/projects/qdpm/ Software Link: https://sourceforge.net/projects/qdpm/ Version: v9.1 Maybe it affect other versions Tested on: Xampp Credit: İsmail BOZKURT Remotely: Yes...

Tryton v5.4 - (Name) Persistent Cross Site Vulnerability

Document Title: =============== Tryton v5.4 - Name Persistent Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2233 ID: https://discuss.tryton.org/t/security-release-for-issue9351/2772 Release Date: ============= 2020-05-11...

Topcoder: CSRF on https://apps.topcoder.com/wiki/users/editmyprofilepicture.action

Summary: Hi : There is a CSRF on uploading user profile photo and saving it. Steps To Reproduce: There is no CSRF token or anything like that on https://apps.topcoder.com/wiki/users/editmyprofilepicture.action . I added the poc html files below. Attacker can upload a new profile photo and update...

CVE-2020-6828

A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference value...

CVE-2020-6828

Mode C - Detailed summary: CVE-2020-6828 affects Firefox for Android and is part of a set of fixes in Firefox ESR updates. The vulnerability arises when a malicious Android app crafts an Intent that Firefox for Android processes, potentially enabling a crafted user.js to overwrite preferences in ...

CVE-2020-6828

A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference value...

Nagios Log Server Cross-Site Scripting (CVE-2020-6586)

A stored cross-site scripting vulnerability exists in Nagios Log Server. This vulnerability is due to insufficient validation of user profile information in the user profile page...

CVE-2018-12383

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is...