HexoEditor Cross-Site Scripting Vulnerability

HexoEditor is an open source for Hexo blogging framework has been optimized for Markdown a markup language that can be written using a regular text editor editor. A cross-site scripting vulnerability exists in HexoEditor v1.1.8-beta. The vulnerability stems from a lack of proper validation of...

Zammad Cross-Site Scripting Vulnerability (CNVD-2019-23066)

Zammad is a suite of ticket management software from the German company Zammad. A cross-site scripting vulnerability exists in Zammad 2.3.0 and prior versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this...

Teclib GLPI Cross-Site Scripting Vulnerability

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A cross-site scripting vulnerability exists in the...

WordPress Appointment Hour Booking Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Appointment Hour Booking plugin is an online booking plugin used in it. A cross-site scripting vulnerability exists in WordPress...

Apache Roller Cross-Site Scripting Vulnerability (CNVD-2019-23302)

Apache Roller is the U.S. Apache Apache Software Foundation's set of Java-based multi-user open source blogging system. A cross-site scripting vulnerability exists in Apache Roller versions 5.2.2, 5.2.1 and 5.2. The vulnerability stems from the WEB application's lack of proper validation of...

Leanote cross-site scripting vulnerability (CNVD-2019-22606)

Leanote is an open source notepad application. A cross-site scripting vulnerability exists in versions prior to Leanote 2.6. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute client-side code...

Tenda D301 Cross-Site Scripting Vulnerability

Tenda D301 is a wireless router from Tenda China. A cross-site scripting vulnerability exists in Tenda D301 v2. The vulnerability stems from the lack of proper validation of client data by a web application. An attacker can exploit this vulnerability to execute client-side code...

Nagios XI Cross-Site Scripting Vulnerability (CNVD-2019-23522)

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A cross-site scripting vulnerability exists in the Auto-Login administrator management page in Nagios XI...

Trape Cross-Site Scripting Vulnerability (CNVD-2019-22229)

Trape is a suite of open source Internet tracking and identification tools. The tool is capable of remotely identifying sessions and simulating phishing attacks. A cross-site scripting vulnerability exists in the static/js/trape.js file in Trape 2019-05-08 and earlier versions. The vulnerability...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2019-30620)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in the AFM feed list in the F5 BIG-IP AFM and ASM, which can be exploited by an...

Trint Ltd: Insecure Zendesk SSO implementation by generating JWT client-side

Summary: app.trint.com implements SSO to Zendesk, it does this by using JWT as described at https://support.zendesk.com/hc/en-us/articles/203663816-Enabling-JWT-JSON-Web-Token-single-sign-on This functionality has not been implemented securely because the JWT generation happens in the client-side...

Stormshield Network Security Cross-Site Scripting Vulnerability

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. A cross-site scripting vulnerability exists in the command line interface of the SNS web server in Stormshield Network Security versions 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1...

DIGISOL SYSTEMS Wireless Wifi Home Router HR-3300 Cross-Site Scripting Vulnerability

DIGISOL SYSTEMS Wireless Wifi Home Router HR-3300 is a home wireless router from DIGISOL SYSTEMS India. A cross-site scripting vulnerability exists in the DIGISOL SYSTEMS Wireless Wifi Home Router HR-3300. The vulnerability stems from the lack of proper validation of client data by the WEB...

Cross-site scripting vulnerability in multiple F5 products (CNVD-2019-32053)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in multiple F5 products. An attacker can exploit the vulnerability to execute...

GLPI Cross-Site Scripting Vulnerability (CNVD-2019-21438)

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A cross-site scripting vulnerability exists in the inc/user.class.php file i...

Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2019-21429)

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. A cross-site scripting vulnerability exists in Subrion CMS versions prior to 4.1.4, which stems from a lack of proper...

Linear eMerge E3-Series Cross-Site Scripting Vulnerability

The Nortek Security & Control Linear eMerge E3-Series is an access control device from Nortek Security & Control USA. A cross-site scripting vulnerability exists in the Linear eMerge E3-Series. The vulnerability stems from a lack of proper validation of client data by the web application. An...

CVE-2019-10721

BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx...

CVE-2019-10721

BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx...

Design/Logic Flaw

BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx...