Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2019-36981)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange OX App Suite versions 7.10.1 and 7.10.2. The vulnerabili...

UBUNTU-CVE-2019-17223

There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php...

Intelbras Router WRN150 Cross-Site Scripting Vulnerability

The Intelbras Router WRN150 is a wireless router from Intelbras Brazil. A cross-site scripting vulnerability exists in the Intelbras Router WRN150. An attacker can exploit the vulnerability to execute arbitrary script code in the context of the affected site. This allows an attacker to steal...

cPanel Input Validation Error Vulnerability (CNVD-2019-36123)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An input validation error vulnerability exists in cPanel. Detailed vulnerability details are not available at this time...

PHPOK has an arbitrary file download vulnerability

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. PHPOK arbitrary file download vulnerability, attackers can use the vulnerability of any read, download files, access to sensitive information...

Atlassian Crowd Session Fixation Vulnerability

Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multiple users, web applications, and directory servers. A security vulnerability exists in Atlassian Crowd versions prior to 3.0.2 and 3.1.0...

Atlassian Crowd XXE Vulnerability

Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multiple users, web applications, and directory servers. A security vulnerability exists in Atlassian Crowd versions prior to 3.0.2 and 3.1.0...

PYSEC-2019-151

sendemail in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent ...

Design/Logic Flaw

Jiangnan Online Judge aka jnoj 0.8.0 has XSS via the Problemtitle parameter to web/polygon/problem/create or web/polygon/problem/update or web/admin/problem/create...

CVE-2018-21024

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

Sql injection

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an authenticated, remote attacker to impact the confidentiality of an affected system by executing arbitrary SQL queries. The...

CVE-2019-1915

CVE-2019-1915 affects Cisco Unified Communications Manager (CUCM), including SME, IM&P, and Unity Connection web interfaces. The root cause is insufficient CSRF protections, allowing an unauthenticated, remote attacker to trick a user into visiting a malicious page and issue arbitrary requests on...

Code Execution Vulnerabilities in the Background of Wild Rain Novel CMS

Wild Rain Fiction Content Management System provides a lightweight fiction website solution based on ThinkPHP 5.1+MySQL. Rain Novel cms backend code execution vulnerabilities , attackers can use the vulnerability to obtain server privileges...

CVE-2019-16894

download.php in inoERP 4.15 allows SQL injection through insecure deserialization...

CVE-2019-6837

A Server-Side Request Forgery SSRF: CWE-918 vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could cause server...

Piwigo Cross-Site Scripting Vulnerability (CNVD-2019-31999)

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time, and more. A cross-site scripting vulnerability exists in Piwigo version 2.9.5 in admin.php?page=accountbilling. The vulnerability...

XSS vulnerability in Guojiz URL navigation system (CNVD-2019-35041)

Guojiz website navigation system is a navigation website source code system developed by PHP+MySQL. Guojiz navigation system XSS vulnerability, an attacker can exploit the vulnerability to obtain background user cookie information...

SQL injection vulnerability in the online petition system ws***.ashx page of Jiangsu Chuhuai Software Technology Development Co.

Jiangsu Chuhuai Software Technology Development Co., Ltd. to develop software products, products covering the National People's Congress, the Chinese People's Political Consultative Conference, the Discipline Inspection Commission, organization, letters and visits, meteorology, agriculture, food...

CVE-2019-5069

Epignosis eFront LMS v5.2.12 is affected by a PHP deserialization code execution vulnerability (CVE-2019-5069). Cisco Talos (TALOS-2019-0858) describes unsafe deserialization of untrusted data leading to remote code execution. Affected component is the LMS PHP backend; deserialization occurs when...

Palo Alto Software: Clickjacking

Summary Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of the...