Qualys Cloud Platform 2.43 New Features

This release of the Qualys Cloud Platform version 2.43 includes updates and new features for Web Application Scanning, highlights as follows. Web Application Scanning Editable QID Severity – The severity of WAS QIDs can now be changed to better match your organization's internal policies...

Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)

Adive Framework 2.0.8 - Cross-Site Request Forgery Change Admin Password Exploit Title: Adive Framework 2.0.8 - Cross-Site Request Forgery Change Admin Password Exploit Author: Sarthak Saini Date: 2020-01-18 Vendor Link : https://www.adive.es/ Software Link:...

fondtaktak.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1076299 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

ersatzteile-triumph.de Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8544 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting ersatzteile-triumph.de website and its users. Following...

WordPress Database Reset Plugin Vulnerability (CVE-2020-7047, CVE-2020-7048)

A vulnerability recently disclosed by Wordfence and published as CVE-2020-7047 and CVE-2020-7048 allows an attacker to take over vulnerable WordPress-based websites. Functionality in the WP Database Reset plugin introduced the vulnerability, which allows any unauthenticated user to reset any tabl...

sportsandchat.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1073064 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Cisco Email Security Appliance Cross-Site Scripting Vulnerability

Cisco Email Security Appliance ESA is an email security appliance from Cisco in the U.S. AsyncOS Software is the operating system that runs on it. A cross-site scripting vulnerability exists in the Cisco Email Security Appliance 13.0 and prior versions. The vulnerability stems from a lack of prop...

Engel & Völkers Technology GmbH BBP: Stored XSS in Watch Lists

Summary: Hi team, I added a house to my Watch List by clicking "Star" button in a property. And I saw this request. █████ Firstly, I changed value of the title parameter to alertdocument.cookie and I sent this request. But the name of property was same in my Watch list. So I tried to change IDs i...

SMC Networks SMC D3G0804W Cross-Site Scripting Vulnerability

The SMC Networks SMC D3G0804W is a wireless router from SMC Networks USA. A cross-site scripting vulnerability exists in SMC Networks SMC D3G0804W version 3.5.2.5-LATGA. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the...

goinginternational.eu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1071059 Security Researcher metamorfosec Helped patch 1957 vulnerabilities Received 9 Coordinated Disclosure badges Received 31 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting goinginternational.eu...

UHP UHP-100 cross-site scripting vulnerability (CNVD-2020-07243)

The UHP-100 is a high-performance router designed for large-scale deployment in broadband VSAT networks. A cross-site scripting vulnerability exists in UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker...

TestLink cross-site scripting vulnerability (CNVD-2020-03254)

TestLink is a set of open source software for managing the software testing process and providing statistical analysis. A cross-site scripting vulnerability exists in TestLink versions prior to 1.9.20. The vulnerability stems from a lack of proper validation of client-side data by the WEB...

Piwigo Cross-Site Scripting Vulnerability (CNVD-2020-03257)

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A cross-site scripting vulnerability exists in Piwigo. The vulnerability stems from the lack of proper validation of client-side data ...

Ruckus ZoneFlex R310 Cross-Site Scripting Vulnerability

The Ruckus ZoneFlex R310 is an indoor 802.11ac Wi-Fi access point. A cross-site scripting vulnerability exists in the Ruckus ZoneFlex R310 version 104.0.0.0.1347, which stems from a lack of proper validation of client data by the WEB application and can be exploited by an attacker to execute...

UHP UHP-100 Cross-Site Scripting Vulnerability

The UHP-100 is a high-performance router designed for large-scale deployment in broadband VSAT networks. A cross-site scripting vulnerability exists in the UHP UHP-100 versions 3.4.1.15, 3.4.2.4, and 3.4.3. The vulnerability stems from the lack of proper validation of client-side data by the WEB...

Cacti Cross-Site Scripting Vulnerability (CNVD-2020-04005)

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . A cross-site scripting vulnerability exists in several files in Cac...

Eclipse Memory Analyzer Cross-Site Scripting Vulnerability

Eclipse Memory Analyzer is a memory analysis tool from the Eclipse Foundation. A cross-site scripting vulnerability exists in Eclipse Memory Analyzer 1.9.1 and prior versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can...

CVE-2020-7227

Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.as...

Information disclosure

Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.as...

CVE-2020-7227

CVE-2020-7227 affects Westermo MRD-315 devices running firmware 1.7.3 and 1.7.4. An information-disclosure vulnerability allows an authenticated remote attacker to retrieve the source code of several web application functions by issuing requests that omit certain mandatory parameters. Affected pa...