The password configured in the FortiWeb's Web Vulnerability Scan profile is visible in cleartext.

...

langhsu mblog 跨站脚本漏洞

Mblog is an open source Java blog system , support for multi-user , support for switching themes. Mblog 3.5 has a cross-site scripting vulnerability , the vulnerability stems from post editing via the post content field . An attacker can use this vulnerability to inject arbitrary Web script or HT...

langhsu mblog 跨站脚本漏洞

Mblog is an open source Java blog system , support for multi-user , support for switching themes. Mblog 3.5 has a cross-site scripting vulnerability that can be exploited to inject arbitrary Web script or HTML via the nickname field in /settings/profile...

The vulnerability of the online service for managing enterprise assets and planning resources in resource-intensive industries like Ellipse EAM stems from the lack of measures taken to protect the website structure. This allows attackers to carry out attacks using cross-site scripting.

The vulnerability of the online service for managing enterprise assets and planning resources in resource-intensive industries exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow attackers to carry out attacks using cross-site...

D-Link DIR-816 操作系统命令注入漏洞

The D-link DIR-816 A2 is a wireless AC750 dual-band router. A remote code injection vulnerability exists in the D-link DIR-816. The vulnerability stems from the availability of HTTP request parameters in the command string construction in the handler function of /goform/dirsetWanWifi. The...

CVE-2020-10583

The /admin/admapi.php script of Invigo Automatic Device Management ADM through 5.0 allows remote authenticated attackers to execute arbitrary OS commands on the server as the user running the application...

Click Ranker vulnerable to cross-site scripting

Overview Click Ranker contains a stored cross-site scripting vulnerability CWE-79 which allows unintentional script execution on the web browser of user who accesses a page ranking screen. During the meeting of Committee for authorizing the disclosure of unresolved vulnerabilities held on January...

Thomas Mortagne xwiki-platform SQL注入漏洞

Xwiki Platform is a Wiki platform for creating Web collaboration applications from the French company Xwiki. XWiki Platform is vulnerable to SQL injection, which can be exploited by attackers to inject SQL statements for execution...

HPESBGN04107 rev.2 - HPE iLO Amplifier Pack, Remote Cross-Site Scripting (XSS) Vulnerability

Potential Security Impact: Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. iLO Amplifier Pack - Prior to version 1.95 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-26580 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:...

The vulnerability of the “cgi-bin/execute_cmd.cgi” implementation of D-Link DSL-2888A router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the “cgi-bin/executecmd.cgi” implementation of D-Link DSL-2888A router microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute...

FUEL CMS 跨站脚本漏洞

FUEL CMS is a content management system based on CodeIgniter. A cross-site scripting vulnerability exists in FUEL CMS 1.4.7. An attacker can exploit this vulnerability to conduct cross-site scripting attacks bypassing filters via /fuelCM/fuel/pages/edit/1?lang=english...

PT-2021-14412 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.4 Description: The issue involves an XSS vulnerability in GLPI, a free asset and IT management software package, where a logged-in user is affected while updating a ticket. Recommendations: For versions prior to...

Synetics i-doit 跨站脚本漏洞

Synetics i-doit is a set of open source configuration management database CMDB software from Synetics Germany. The software includes features such as IT infrastructure management, network document management, IP address management and IT asset management. A cross-site scripting vulnerability exis...

CVE-2021-20069

Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the regionalSettings.php dialogs...

Henriquedornas 跨站脚本漏洞

Henriquedornas is a web framework from Henriquedornas Brazil. Provides a framework for building websites. A cross-site scripting vulnerability exists in Henriquedornas that stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerabilit...

b2evolution 跨站脚本漏洞

B2evolution is a PHP and MySQL-based community content management system. B2evolution cross-site scripting vulnerability can be exploited by attackers to execute malicious JavaScript code via the plugin name input field in the plugin module...

Adobe Magento 跨站脚本漏洞

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

CVE-2021-26723

Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS...

CVE-2020-18717

SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzztemplate.php...

EasyCMS 跨站请求伪造漏洞

EasyCMS is lightweight scalable open source content management program, following the Apache2 open source agreement. A cross-site request forgery vulnerability exists in EasyCMS 1.6. An attacker can add an administrator account via...