Schneider Electric TSXETG100 Cross-Site Scripting Vulnerability

The Schneider Electric TSXETG100 is an Ethernet gateway device from Schneider Electric France. A cross-site scripting vulnerability exists in the Schneider Electric TSXETG100. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker could exploit...

Shave Cross-Site Scripting Vulnerability

Shave is a Javascript plugin that can truncate multiple lines of text according to the set number of pixels max-height. A cross-site scripting vulnerability exists in versions prior to Shave 2.5.3, which can be exploited by attackers to execute client-side code...

ProjectSend cross-site scripting vulnerability (CNVD-2019-36883)

ProjectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A cross-site scripting vulnerability exists in the 'Name' field of the My Account page in versions prior to ProjectSend r1053. The vulnerability stems from the WEB application's lack of proper...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2019-15665)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in Mozilla Firefox versions prior to 67, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit thi...

Computrols CBAS Web Cross-Site Scripting Vulnerability

Computrols CBAS is a building automation system from Computrols USA. A cross-site scripting vulnerability exists in Computrols CBAS Web. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute...

Quest Software KACE Systems Management Appliance Cross-Site Scripting Vulnerability

Quest Software KACE Systems Management Appliance is a systems management appliance from Quest Software, USA. It supports IT asset management, server management and monitoring, software license management and patch management. A cross-site scripting vulnerability exists in Quest Software KACE...

Input validation

Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561. The...

CVE-2019-11536

Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561. The...

CVE-2019-11536

Summary (CVE-2019-11536) Kalkitech SYNC3000 Substation DCU GPC versions 2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1 are affected when WebHMI is not installed. The issue allows an attacker to inject client-side commands or scripts that are executed on the de...

CentOS Web Panel Cross-Site Scripting Vulnerability (CNVD-2019-15668)

CentOS Web Panel CWP is a free web hosting control panel. A cross-site scripting vulnerability exists in CWP 0.9.8.747 and earlier versions. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...

Zoho ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-15667)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...

TP-LINK TL-WR840N v5 XSS Injection Vulnerability

The TP-Link TL-WR840N is a wireless router from China P&L TP-Link. A cross-site scripting vulnerability exists in TP-LINK TL-WR840N v5 00000005 using firmware version 0.9.1 3.16 v0001.0 Build 171211 Rel.58800n. The vulnerability stems from the lack of proper validation of client data by the WEB...

eZ Platform Admin UI Cross-Site Scripting Vulnerability

eZ Platform is an open source enterprise content management system CMS. admin UI is one of the back-end management interface . A cross-site scripting vulnerability exists in the Admin UI in eZ Platform version 2.x, which can be exploited by an attacker to execute client-side code...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2019-25043)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

Applaud HCM Cross-Site Scripting Vulnerability

Applaud HCM is a human resource management application. A cross-site scripting vulnerability exists in Applaud HCM version 4.0.42+ that can be exploited by an attacker to execute client-side code...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

Design/Logic Flaw

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12098

CVE-2019-12098 affects Heimdal Kerberos 5 clients; the issue is failure to verify anonymous PKINIT KX (PA-PKINIT-KX) during the key exchange, enabling potential MITM. Public advisories indicate this was fixed in newer Heimdal releases (e.g., 7.6.0+ and later such as 7.7.0 in openSUSE/SUSE bundles...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

Seagate NAS OS Cross-Site Scripting Vulnerability

Seagate NAS OS is a NAS Network Attached Storage operating system from Seagate USA. A cross-site scripting vulnerability exists in the API error page in Seagate NAS OS version 4.3.15.1. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker cou...