CVE-2013-5978

CVE-2013-5978 : In the WordPress Cart66 Lite plugin (affected version: before 1.5.1.15), multiple XSS vulnerabilities exist in the products.php functionality. Remote attackers can inject arbitrary web script or HTML via the 1) Product name or 2) Price description fields in requests to wp-admin/ad...

Webshell Bypass Vulnerability in Web Security Dog APACHE Version 4.0

Security Dog provides users with lightweight, efficient, reliable and stable cloud security products and a full range of security services. A webshell bypass vulnerability exists in APACHE version 4.0 of Website Security Dog, which can be exploited by attackers to gain access to the control...

Google Chrome Input Validation Error Vulnerability (CNVD-2019-46431)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an input validation error vulnerability. An attacker can exploit this vulnerability to disable extensions via specially crafted HTML pages...

IBM Spectrum Scale CVE-2019-4665 Cross Site Scripting Vulnerability

Description IBM Spectrum Scale is prone to a cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication...

Web Security Dog (Apache Edition) V4.0 suffers from sql injection bypass vulnerability

Website Security Dog is a server tool that integrates website content security protection, website resource protection and website traffic protection functions. Functions covered by the net horse / Trojan scanning, anti-SQL injection, anti-stolen links, anti-CC attacks, real-time website traffic...

The vulnerability of the Cisco Web Security Appliance’s web interface allows a hacker to inject arbitrary code into the web page that is uploaded.

The vulnerability of the Cisco Web Security Appliance web interface relates to insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the loaded web page remotely...

Webshell Bypass Vulnerability in Web Security Dog APACHE Edition

Website Security Dog is a server security protection software, is for IDC operators, web hosting service providers, enterprise hosts, server administrators and other users to provide server security prevention of the practical system, is a combination of website content security protection, websi...

PRO-7070 Hazir Profesyonel Web Sitesi 1.0 SQL Injection

Exploit Title: PRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication Bypass Date: 2019-12-08 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.websitem.biz/hazir-site/pro-7070-hazir-mobil-tablet-uyumlu-web-sitesi Tested on: Kali Linux Version: 1.0 CVE: N/A ----- PoC:...

web-tom1.h-is.co.kr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1033283 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2019-19551

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are no...

Cross site scripting

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are no...

cgbarcelona.galiciaaberta.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1032039 Security Researcher geeknik Helped patch 8803 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

CVE-2019-18381

Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing CORS vulnerability, which is a type of issue that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served...

wedding-staff.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1030552 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

newhols.com Cross Site Scripting vulnerability

Security Researcher Cyberaj Helped patch 3 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting newhols.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty ha...

CVE-2019-5110

Forma LMS 2.2.1 is affected by multiple SQL injection vulnerabilities in authenticated areas. The TALOS advisories confirm exploitable injections in /appCore/index.php (users parameter) and /appLms/ajax.server.php (filter_cat, filter_status) that could allow an attacker to exfiltrate database dat...

CVE-2019-5109

Forma LMS 2.2.1 is affected by SQL injection vulnerabilities in the authenticated portion. The TALOS advisory/TALOS-2019-0902 details SQLi in /appCore/ajax.adm_server.php (dir parameter) and TALOS-2019-0903/0904 describe additional vectors; CVE-2019-5109 covers /appLms/ajax.server.php filter_cat ...

CVE-2019-5112

Forma LMS 2.2.1 is affected by authenticated SQL injection vulnerabilities in the /appLms/ajax.server.php endpoint (parameters filter_cat and filter_status). The TALOS advisory confirms exploitable injections that could lead to exfiltration of database information and, in some configurations, acc...

CVE-2019-18574

RSA Authentication Manager versions prior to 8.4 Patch 8 (8.4.0.8) are affected by a stored cross-site scripting vulnerability in the Security Console. An authenticated Security Console administrator can store arbitrary HTML/JavaScript through the web interface, which may be included in a report ...

angular: Cross-site Scripting (XSS) due to no proper sanitization of xlink:href attributes

A cross-site scripting XSS flaw was found in Angular. This flaw occurs due to improper sanitation of xlink:href attributes, which allows the web application to deliver data to users, along with other trusted content, without proper validation...