2167 matches found
CVE-2019-6296
Cleanto 5.0 has SQL Injection via the assets/lib/exportajax.php id parameter...
HackerOne: Response program can display "eligible for bounty" in scope area in program policy
Hello Hackerone Team and @jobert First of all, Happy new year to everyone. Summary Response program can also display "eligible for bounty" assets on program policy. It's basically causing from backend in terms of GRAPHQL mutation query for eligible in bounty:true which stays forever on response...
FreeBSD : typo3 -- multiple vulnerabilities (bab29816-ff93-11e8-b05b-00e04c1ea73d)
Typo3 core team reports : CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. The vulnerability stemmed from the fact that it was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a...
DomainMOD cross-site scripting vulnerability (CNVD-2019-07965)
DomainMOD is an open source application for managing your domain names and other Internet assets in a central location. DomainMOD 4.11.01 suffers from a cross-site scripting vulnerability that can be exploited by an attacker via the assets/add/category.php Category Name or Stakeholder fields...
CVE-2018-20011
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field...
Default credentials
DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field...
Default credentials
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field...
CVE-2018-20011
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field...
CVE-2018-20011
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field...
CVE-2018-20011
CVE-2018-20011 affects DomainMOD up to version 4.11.01. The vulnerability is a stored XSS via the assets/add/category.php page, specifically in the CatagoryName and StakeHolder fields. Evidence across sources (NVD entry, Nuclei template, Exploit-DB) confirms an XSS payload can be injected after l...
DomainMOD cross-site scripting vulnerability (CNVD-2019-07966)
DomainMOD is an open source application for managing your domain names and other Internet assets in a central location. A cross-site scripting vulnerability exists in DomainMOD versions 4.11.01 and earlier, which can be exploited by an attacker via the assets/add/registrar-accounts.php UserName,...
CVE-2018-19914
DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field...
Default credentials
DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field...
CVE-2018-19915
DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field...
CVE-2018-19914
DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field...
CVE-2018-19913
CVE-2018-19913 affects DomainMOD up to version 4.11.01. The vulnerability is an XSS in assets/add/registrar-accounts.php, exploitable via the UserName, Reseller ID, or Notes fields. Public evidence includes exploit-db/packetstorm references and related CNVD/NVD entries. The connected documents co...
CVE-2018-19914
DomainMOD 4.11.01 contains a Cross-Site Scripting (XSS) vulnerability in assets/add/dns.php where the Profile Name or notes fields can inject JavaScript. Impact: arbitrary JavaScript execution in the victim’s browser, potentially with session hijacking, defacement, or information theft. Affected ...
CVE-2018-19752
DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar...