pki-core cross-site scripting vulnerability (CNVD-2020-27181)

pki-core is a library that provides an API for PKI operations. A cross-site scripting vulnerability exists in pki-core. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Nagios XI Cross-Site Scripting Vulnerability (CNVD-2020-19533)

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A cross-site scripting vulnerability exists in Nagios XI version 5.6.11. The vulnerability stems from the...

Nagios XI Cross-Site Scripting Vulnerability (CNVD-2020-19531)

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A cross-site scripting vulnerability exists in Nagios XI version 5.6.11. The vulnerability stems from the...

pki-core cross-site scripting vulnerability (CNVD-2020-27180)

pki-core is a library that provides an API for PKI operations. A cross-site scripting vulnerability exists in pki-core. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

pki-core cross-site scripting vulnerability (CNVD-2020-27182)

pki-core is a library that provides an API for PKI operations. A cross-site scripting vulnerability exists in pki-core. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

uDork - Google Hacking Tool

uDork is a script written in Python that uses advanced Google search techniques to obtain sensitive information in files or directories, find IoT devices, detect versions of web applications, and so on. uDork does NOT make attacks against any server, it only uses predefined dorks and/or official...

Staging.every.org: Improper email address verifiation while saving Account Details

Summary: Attacker could be able change its email to any email address even already created another user's email address.Even though UI doesnot allow it Steps To Reproduce: 0. Set up proxy. 1. Singup with any email address 2. Go to profile section 3. Click on update button 4. Monitor call in rever...

Canon Oce Colorwave 500 Cross-Site Scripting Vulnerability (CNVD-2020-18989)

The Canon Oce Colorwave 500 is a printer from Canon Japan. A cross-site scripting vulnerability exists in the /TemplateManager/indexExternalLocation.jsp file of the web application in Canon Oce Colorwave 500 version 4.0.0.0. The vulnerability stems from the WEB application lacking proper validati...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-22261)

Ignite Realtime Openfire is the Ignite Realtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open source real-time collaboration RTC server , it can build a highly efficient instant messaging server , and supports tens of...

ERPNext cross-site scripting vulnerability (CNVD-2020-19004)

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...

Canon Oce Colorwave 500 cross-site scripting vulnerability (CNVD-2020-18988)

The Canon Oce Colorwave 500 is a printer from Canon Japan. A cross-site scripting vulnerability exists in the 'settingId' parameter of the settingDialogContent.jsp page of the web application in Canon Oce Colorwave 500 version 4.0.0.0. The vulnerability stems from a lack of proper validation of...

Open edX Cross-Site Scripting Vulnerability

Open edX is an online learning management system. A cross-site scripting vulnerability exists in Open edX Ironwood.1, which stems from the lack of proper validation of client data in the WEB application and can be exploited by an attacker to execute client-side code...

ERPNext cross-site scripting vulnerability (CNVD-2020-19000)

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...

Canon Oce Colorwave 500 CSRF Vulnerability

The Canon Oce Colorwave 500 is a printer from Canon Japan. A security vulnerability exists in the web application in Canon Oce Colorwave 500 version 4.0.0.0, which stems from the program not having any form of cross-site request forgery protection. An attacker could exploit the vulnerability to...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2020-21240)

CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in Filemanager...

CVE-2020-10669

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the late...

Authentication flaw

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the late...

CVE-2020-10669

The Canon Oce Colorwave 500 printer web interface (version 4.0.0.0) is affected by CVE-2020-10669 due to an authentication bypass on /home.jsp. An unauthenticated attacker who can reach the device’s web UI can obtain copies of documents uploaded by users. The issue is confirmed in multiple source...

CVE-2020-10669

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the late...

CVE-2020-10670

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version...