web-tom1.h-is.co.kr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1033283 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2019-19551

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are no...

Cross site scripting

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are no...

cgbarcelona.galiciaaberta.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1032039 Security Researcher geeknik Helped patch 8803 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

CVE-2019-18381

Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing CORS vulnerability, which is a type of issue that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served...

wedding-staff.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1030552 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

newhols.com Cross Site Scripting vulnerability

Security Researcher Cyberaj Helped patch 3 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting newhols.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty ha...

CVE-2019-5110

Forma LMS 2.2.1 is affected by multiple SQL injection vulnerabilities in authenticated areas. The TALOS advisories confirm exploitable injections in /appCore/index.php (users parameter) and /appLms/ajax.server.php (filter_cat, filter_status) that could allow an attacker to exfiltrate database dat...

CVE-2019-5109

Forma LMS 2.2.1 is affected by SQL injection vulnerabilities in the authenticated portion. The TALOS advisory/TALOS-2019-0902 details SQLi in /appCore/ajax.adm_server.php (dir parameter) and TALOS-2019-0903/0904 describe additional vectors; CVE-2019-5109 covers /appLms/ajax.server.php filter_cat ...

CVE-2019-5112

Forma LMS 2.2.1 is affected by authenticated SQL injection vulnerabilities in the /appLms/ajax.server.php endpoint (parameters filter_cat and filter_status). The TALOS advisory confirms exploitable injections that could lead to exfiltration of database information and, in some configurations, acc...

CVE-2019-18574

RSA Authentication Manager versions prior to 8.4 Patch 8 (8.4.0.8) are affected by a stored cross-site scripting vulnerability in the Security Console. An authenticated Security Console administrator can store arbitrary HTML/JavaScript through the web interface, which may be included in a report ...

angular: Cross-site Scripting (XSS) due to no proper sanitization of xlink:href attributes

A cross-site scripting XSS flaw was found in Angular. This flaw occurs due to improper sanitation of xlink:href attributes, which allows the web application to deliver data to users, along with other trusted content, without proper validation...

CVE-2019-3665

CVE-2019-3665 affects the web interface of McAfee Web Advisor (WA) for versions before 4.1.1.48. The issue is a code injection vulnerability that allows a remote unauthenticated attacker to cause the browser to render websites that WA would normally block when presented via a carefully crafted si...

Intelbras Router RF1200 1.1.3 - Cross-Site Request Forgery

Intelbras Router RF1200 1.1.3 - Cross-Site Request Forgery Exploit Title: Intelbras Router RF1200 1.1.3 - Cross-Site Request Forgery Date: 2019-11-06 Exploit Author: Joas Antonio Vendor Homepage: intelbras.com.br Software Link:...

Arbitrary File Deletion Vulnerability in Super Cms

Super CMS content management system hereinafter referred to as the product by the SEO Research Center in order to solve the problem of website optimization and research and development of a set of products , this product adopts an object-oriented approach to self-help research and development of...

ChakraCore JavaScript RCE

The vulnerability of the ChakraCore JavaScript script handler in Microsoft Edge and Internet Explorer is related to errors in memory object handling. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially crafted web page...

org.apache.nifi:nifi-framework-cluster (>=1.3.0, <=1.9.2), org.apache.nifi:nifi-framework-nar (>=1.3.0, <=1.9.2) +5 more potentially affected by CVE-2019-12421 via org.apache.nifi:nifi-web-security (>=1.3.0, <=1.9.2)

org.apache.nifi:nifi-web-security MAVEN version =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.9.2 Source cves: CVE-2019-12421 Source advisory: OSV:GHSA-FMQW-VQH5-CWQ9...

org.apache.nifi:nifi-framework-cluster (>=1.3.0, <=1.9.2), org.apache.nifi:nifi-framework-nar (>=1.3.0, <=1.9.2) +5 more potentially affected by CVE-2019-12421 via org.apache.nifi:nifi-web-security (>=1.3.0, <=1.9.2)

org.apache.nifi:nifi-web-security MAVEN version =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.9.2 Source cves: CVE-2019-12421 Source advisory: GHSA-FMQW-VQH5-CWQ9...

SmartHouse Webapp 6.5.33 - Cross-Site Request Forgery

Exploit Title: SmartHouse Webapp 6.5.33 - Cross-Site Request Forgery Discovery by: LiquidWorm Date: 2019-12-02 Vendor Homepage: Tested Version: 6.5.33.17072501 CVE: N/A Advisory ID: ZSL-2019-5543 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5543.php Carlo Gavazzi SmartHous...

Forma LMS 2.2.1 /appLms/ajax.server.php filter_cat and filter_status parameters SQL injections

Summary Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...