Dolibarr ERP/CRM Cross-Site Scripting Vulnerability (CNVD-2019-39368)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site scripting vulnerability exists in Dolibarr ERP/CR...

Dolibarr ERP/CRM Cross-Site Scripting Vulnerability (CNVD-2019-39370)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site scripting vulnerability exists in Dolibarr ERP/CR...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-38071)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX 4.5.7 and earlier versions, which...

Thycotic Secret Server Cross-Site Scripting Vulnerability (CNVD-2019-38073)

Thycotic Secret Server is a privileged account management solution from Thycotic USA. A cross-site scripting vulnerability exists in Thycotic Secret Server versions prior to 10.7. The vulnerability stems from the lack of proper validation of client-side data by the WEB application, and can be...

Celebrate Cybersecurity Awareness Month with These Tips From a Survey of 1,200 Security Pros

Held every October, National Cybersecurity Awareness Month NCSAM is a collaborative effort between government and industry meant to raise awareness about the importance of cybersecurity. NCSAM is focused largely on consumer awareness, but for cybersecurity leaders, it is also a great opportunity ...

sei.tce.rr.leg.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1001363 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

New Cache Poisoning Attack Lets Attackers Target CDN Protected Sites

A team of German cybersecurity researchers has discovered a new cache poisoning attack against web caching systems that could be used by an attacker to force a targeted website into delivering error pages to most of its visitors instead of legitimate content or resources. The issue could affect...

Intelbras IWR 1000N Cross-Site Request Forgery Vulnerability

Intelbras IWR 1000N is a wireless router from Intelbras Poland. A cross-site request forgery vulnerability exists in the Intelbras IWR 1000N. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could exploit th...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-36990)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX 4.5.7 and prior versions. The...

Totemo totemodata Cross-Site Scripting Vulnerability

Totemo totemodata is an enterprise secure file transfer solution from Totemo Switzerland. A cross-site scripting vulnerability exists in Totemo totemodata version 3.0.0b936, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-37878)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX 4.5.7 and earlier versions, which...

RICOH MP 501 Cross-Site Scripting Vulnerability

The RICOH MP 501 is a printer from Ricoh RICOH Japan. A cross-site scripting vulnerability exists in the add address area of the RICOH MP 501, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute client-side code...

Sangoma SBC 2.3.23-119-GA Unauthenticated User Creation Vulnerability

A remotely exploitable vulnerability exists in the 2.3.23-119-GA version of Sangoma SBC that would allow an unauthenticated user to create a privileged user on the system using the web application login interface. Description A remotely exploitable vulnerability exists in the 2.3.23-119-GA versio...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-37885)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX 4.5.7 and earlier versions, which...

New & Improved Qualys WAS Burp Extension Now Available

Last year we released the initial version of the Qualys WAS Burp extension to positive reviews. Customers welcomed the ability to send Burp-identified issues into Qualys Web Application Scanning WAS for centralized viewing and reporting of automated scanner findings plus manual pen-test issues fr...

CVE-2019-14862

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it...

Code Injection

sagecell is vulnerable to arbitrary code injection. The vulnerability exists as it allows injection of malicious OS commands via the popen command during communication with the SageMath Sage Cell Server via an internet facing web application.The vendor claims this vulnerability as a "vulnerable b...

Command Execution Vulnerability in Pluck-CMS

Pluck is a very simple and easy to use CMS Content Management System for PHP platforms. A command execution vulnerability exists in Pluck-CMS, which can be exploited by an attacker to execute remote code to gain privileges in a web application...

CVE-2019-17526

An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an import'os'.popen'whoami'.read...

CVE-2019-17526

An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an import'os'.popen'whoami'.read...