Perfex v2.4.4 CRM - (Print) Persistent Web Vulnerability

Document Title: =============== Perfex v2.4.4 CRM - Print Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2231 Release Date: ============= 2020-06-23 Vulnerability Laboratory ID VL-ID: ==================================== 22...

CVE-2020-13480

Verint Workforce Optimization WFO 15.2 allows HTML injection via the "send email" feature...

grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL

An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer...

undertow: invalid HTTP request with large chunk size

A flaw was found in Undertow, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling...

SAP Fiori Input Validation Error Vulnerability

SAP Fiori, a user experience UX design system for SAP applications from SAP, Germany, provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, delivering a consistent, innovative experience for creators and users. An input validation...

74cms Arbitrary File Deletion Vulnerability

74cms is a free and open source professional recruitment system based on PHP+MYSQL as the core development. 74cms arbitrary file deletion vulnerability , an attacker can use the vulnerability to delete any file...

Stored Cross-Site Scripting Vulnerability in YzmCMS

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture, YzmCMS can run on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMS has a stored cross-site scripting vulnerability. An attacker can exploit the vulnerability to obtain an administrator cookie...

IBM Security Guardium Cross-Site Scripting Vulnerability (CNVD-2020-32644)

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A cross-site scripting vulnerability exists in IBM Security Guardium...

XSS Vulnerability at jfinal cms comment feeds

jfinal cms is a java development of powerful information consulting website , using a simple and powerful JFinal as the web framework , template engine with beetl, database with mysql, front-end bootstrap framework. jfinal cms feedback at the existence of XSS vulnerability , an attacker can explo...

Lexiglot Cross-Site Scripting Vulnerability

Lexiglot is a translation platform written in PHP by the French software developer Damien Sorel. A cross-site scripting vulnerability exists in Lexiglot 2014-11-20 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacke...

Stored Cross-site Scripting Vulnerability in the Frontend of Guojiz Web Site Navigation System

Guojiz website navigation system is a navigation website source code developed by PHP+MySQL. A stored cross-site scripting vulnerability exists in the frontend of the Guojiz web navigation system. An attacker can exploit the vulnerability to obtain sensitive information such as user cookies...

Information Leakage Vulnerability in the Appointment Registration System of Nanjing Medical Healthcare Information Technology Co.

Ltd. is a high-tech growing enterprise in China Nanjing Software Valley. Nanjing Medical Healthcare Appointment and Registration System has the features of unified number pool for internal and external networks, multi-appointment channels, registration and appointment to the point of time,...

CVE-2020-4298

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-For...

CVE-2020-12677

An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. This affects 2018 - 2018.0 prior to 2018.0.3, 20...

The vulnerability in the vManage web interface of the software-defined Cisco SD-WAN network allows a attacker to execute arbitrary SQL queries.

The vulnerability in the vManage web interface of the Cisco SD-WAN programmatically defined network is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

XSS vulnerability in WeCenter aj***.php

WeCenter is an open source knowledge-based social Q&A community program. An XSS vulnerability exists in WeCenter aj.php, which can be exploited by an attacker to obtain user cookie information...

Stored Cross-Site Scripting Vulnerability in Graphite Document Personal and Enterprise Editions

Graphite Document is an enterprise office service software that supports real-time collaboration in the cloud with features analogous to Google Docs and Quip, which enables multiple people to edit and discuss in real time on the same document and form at the same time, with a synchronized respons...

Sentrifugo CMS 3.2 Cross Site Scripting

Document Title: =============== Sentrifugo v3.2 CMS - Persistent XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2229 Release Date: ============= 2020-05-05 Vulnerability Laboratory ID VL-ID: ==================================== 22...

Wordpress Theme Dosimple v2.0 - XSS Web Vulnerability

Document Title: =============== Wordpress Theme Dosimple v2.0 - XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2251 Release Date: ============= 2020-05-06 Vulnerability Laboratory ID VL-ID: ==================================== 225...

Dell EMC RSA Archer Cross-Site Request Forgery Vulnerability

Dell EMC RSA Archer is an enterprise IT governance and compliance governance product from Dell USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. A cross-site request forgery vulnerability exists in versions prior to De...