D-Link DIR-655 C Cross-Site Scripting Vulnerability

The D-Link DIR-655 C is a wireless router from AUO D-Link of Taiwan, China. A cross-site scripting vulnerability exists in the D-Link DIR-655 C prior to version 3.02B05 BETA03. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploi...

Dolibarr cross-site scripting vulnerability (CNVD-2019-23348)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site scripting vulnerability exists in the...

MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting

Exploit Title: MyT Project Management - Userusername Stored Cross Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://manageyourteam.net/index.html Software Link: https://sourceforge.net/projects/myt/files/latest/download Version: 1.5.1 Category: Webapps Tested o...

Eventum Cross-Site Scripting Vulnerability (CNVD-2019-39387)

Eventum is a defect tracking system. The system is used to track inbound technical support, organizational tasks, bugs, etc. A cross-site scripting vulnerability exists in the /htdocs/popup.php file in Eventum version 3.5.0. The vulnerability stems from a lack of proper validation of client-side...

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting Exploit Title: Stored Cross Site Scripting XSS in Sitecore 9.0 rev 171002 Date: July 11, 2019 Exploit Author: Owais Mehtab Vendor Homepage: http://www.sitecore.net/en Version: 9.0 rev. 171002 Tested on: Sitecore Experience Platform 8.1...

CVE-2019-13071

CVE-2019-13071 affects PowerPanel Business Edition 3.4.0 (Agent/Center component). The vulnerability is a CSRF flaw that allows an attacker to submit POST requests to arbitrary forms within the web application by convincing an authenticated user to visit a malicious page. This can enable actions ...

brusselsjazzweekend.be Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-885239 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting brusselsjazzweekend.be websit...

Security Updates for Microsoft .NET Framework (July 2019)

The Microsoft .NET Framework installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An authentication bypass vulnerability exists in Windows Communication Foundation WCF and Windows Identity Foundation WIF, allowing signing of SAML...

CVE-2019-9147

Mailvelope CVE-2019-9147 affects the Mailvelope browser extension before version 3.1.0. The vulnerability is a clickjacking issue on the settings page, which is intended to be embedded by web apps. The problem arises because the browser extension isolation mechanisms are disabled via web_accessib...

Design/Logic Flaw

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

.NET Denial of Service Vulnerability

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this...

Appointment Hour Booking <= 1.1.45 - Stored Cross-Site Scripting (XSS)

It is possible for an unauthenticated user to inject malicious JavaScript into a booking form, which will then be executed when an authenticated user views the booking in the WordPress admin interface. PoC POST /booking-form/ HTTP/1.1 Host: test.local User-Agent: Mozilla/5.0 Macintosh; Intel Mac ...

ICSA-19-192-03 Siemens TIA Administrator (TIA Portal)

1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION : Low skill level to exploit Vendor : Siemens Equipment : TIA Administrator TIA Portal Vulnerability : Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an execution of some commands without proper...

D-Link Central WiFi Manager CWM(100) RCE

This module exploits a PHP code injection vulnerability in D-Link Central WiFi Manager CWM100 versions below v1.03R0100BETA6. The vulnerability exists in the username cookie, which is passed to eval without being sanitized. Dangerous functions are not disabled by default, which makes it possible ...

GetSimple CMS <= 3.3.16 RCE Vulnerability

GetSimple CMS is prone to a remote code execution RCE vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Discuz!ML v3.x - Code Injection Vulnerability

Document Title: =============== Discuz!ML v3.x - Code Injection Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2185 Download: https://www.vulnerability-lab.com/resources/documents/2185.rar http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13956...

DIGISOL SYSTEMS DG-HR3400 Cross-Site Scripting Vulnerability

DIGISOL SYSTEMS DG-HR3400 is a wireless router from DIGISOL SYSTEMS India. A cross-site scripting vulnerability exists in the DIGISOL SYSTEMS DG-HR3400. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to...

Moxa OnCell G3100-HSPA Cross-Site Request Forgery Vulnerability

Moxa OnCell G3100-HSPA is a G3100-HSPA series cellular network gateway device from Moxa, Taiwan, China. A cross-site request forgery vulnerability exists in the DE WEB application in Moxa OnCell G3100-HSPA 1.4 Build 16062919 and prior firmware versions, which stems from the WEB application not...

Authentication flaw

A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker can brute force parameters required to bypass authentication and access the web interface to use all its functions except for password change...

CVE-2018-11426

The CVE-2018-11426 entry concerns the Moxa OnCell G3100-HSPA Series web interface (versions 1.4 Build 16062919 and earlier). A weak Cookie parameter allows brute-forcing to bypass authentication and access the web UI with full functionality except password changes. The vulnerability context acros...