CHIYU BF430 TCP IP Converter Cross-Site Scripting Vulnerability

CHIYU BF-430 is a networking server that provides communication for access control, time and attendance system and other devices from CHIYU Technology CHIYU in Taiwan, China. A cross-site scripting vulnerability exists in CHIYU BF-430 232/485 TCP/IP Converter versions prior to 1.16.00. The...

Wowza Streaming Engine Code Execution Vulnerability

Wowza Streaming Engine is a streaming media server software from Wowza Media Systems. The program supports live streaming, VOD, online video chat, and remote recording. A security vulnerability exists in Wowza Streaming Engine. The vulnerability stems from the lack of proper validation of client...

Lexmark printer cross-site scripting vulnerability

Lexmark printers is a printer product of Lexmark USA. A cross-site scripting vulnerability exists in the Lexmark printer MS812 and several previous series printers. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this...

Piwigo < 2.10.2 Multiple Vulnerabilities

Piwigo is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2014-2595

Barracuda Web Application Firewall WAF 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string...

ASUS WRT-AC66U Cross-Site Scripting Vulnerability (CNVD-2020-04914)

The ASUS WRT-AC66U is a product of Asus Taiwan, China. A cross-site scripting vulnerability exists in the ASUS WRT-AC66U. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

CVE-2020-8429

The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be exploited to allow an authenticated attacker to run remote code on the underlying operating system. The logFile parameter in the getLogs...

CVE-2020-8429

The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be exploited to allow an authenticated attacker to run remote code on the underlying operating system. The logFile parameter in the getLogs...

CVE-2020-8429

CVE-2020-8429 affects the Admin web application in Kinetica 7.0.9.2.20191118151947. The flaw stems from insufficient sanitisation of input to the getLogs function, where the logFile parameter is interpolated into a shell command to read log files. Due to poor sanitisation, an authenticated attack...

Microsoft Exchange Validation Key Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Exchange Server when the server fails to properly create unique keys at install time. Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web application, which...

Gchq stroom cross-site scripting vulnerability

Stroom is a scalable data storage, processing and analytics platform. A cross-site scripting vulnerability exists in Gchq stroom. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side...

WSO2 API Manager Cross-Site Scripting Vulnerability (CNVD-2020-05090)

WSO2 API Manager is an open source api management platform , provides a series of api creation , release , lifecycle management , version control , monetization, governance and security features , used to support organizations to achieve soa. A cross-site scripting vulnerability exists in WSO2 AP...

Fixed in Apache Tomcat 9.0.31

Important: AJP Request Injection and potential Remote Code Execution CVE-2020-1938 When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. I...

Zimbra Collaboration Cross-Site Scripting Vulnerability (CNVD-2020-05085)

Zimbra Collaboration is a suite of email and collaboration solutions from Zimbra USA. The solution offers email, contacts, calendaring, file sharing, social networking, and more. A cross-site scripting vulnerability exists in Zimbra Collaboration. The vulnerability stems from the WEB application...

Ratpack Cross-Site Scripting Vulnerability

Ratpack is a Java library for building scalable HTTP applications. A cross-site scripting vulnerability exists in Ratpack. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

WSO2 API Manager Cross-Site Scripting Vulnerability (CNVD-2020-05094)

WSO2 API Manager is an open source api management platform , provides a series of api creation , release , lifecycle management , version control , monetization, governance and security features , used to support organizations to achieve soa. A cross-site scripting vulnerability exists in WSO2 AP...

WSO2 API Manager Cross-Site Scripting Vulnerability (CNVD-2020-05075)

WSO2 API Manager is an open source api management platform , provides a series of api creation , release , lifecycle management , version control , monetization, governance and security features , used to support organizations to achieve soa. A cross-site scripting vulnerability exists in WSO2 AP...

Adive Framework Cross-Site Scripting Vulnerability (CNVD-2020-04937)

Adive Framework is a PHP-based MySQL database management framework . A cross-site scripting vulnerability exists in Adive Framework. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute client-si...

Adive Framework Cross-Site Request Forgery Vulnerability

Adive Framework is a PHP-based MySQL database management framework . A cross-site request forgery vulnerability exists in Adive Framework. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could exploit this...

WSO2 API Manager Cross-Site Scripting Vulnerability (CNVD-2020-05093)

WSO2 API Manager is an open source api management platform , provides a series of api creation , release , lifecycle management , version control , monetization, governance and security features , used to support organizations to achieve soa. A cross-site scripting vulnerability exists in WSO2 AP...