cPanel Cross-Site Scripting Vulnerability (CNVD-2019-26361)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in versions prior to cPanel 70.0.23. The vulnerability stems from a lack of...

Magento cross-site scripting vulnerability (CNVD-2019-26244)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A cross-site scripting vulnerability exists in the admin panel in Magento versions 2.1.18 before 2.1, 2.2.9 befor...

More on Backdooring (or Not) WhatsApp

Yesterday, I blogged about a Facebook plan to backdoor WhatsApp by adding client-side scanning and filtering. It seems that I was wrong, and there are no such plans. The only source for that post was a Forbes essay by Kalev Leetaru, which links to a previous Forbes essay by him, which links to a...

Editor.md Cross-Site Scripting Vulnerability

Editor.md is an open source embedded online Markdown a markup language editor. A cross-site scripting vulnerability exists in Editor.md version 1.5.0, which stems from the lack of proper validation of client-side data in a web application and can be exploited by an attacker to execute client-side...

No summer break for Magecart as web skimming intensifies

This summer, you are more likely to find the cybercriminal groups Magecart client-side rather than poolside. Web skimming, which consists of stealing payment information directly from within the browser, is one of today's top web threats. Magecart, the group behind many of these attacks, gained...

WallacePOS Cross-Site Scripting Vulnerability (CNVD-2019-25985)

WallacePOS is an open source, web-based POS and business management system. The system is compatible with standard POS hardware such as receipt printers, cash drawers and barcode scanners. A cross-site scripting vulnerability exists in WallacePOS version 1.4.3. The vulnerability stems from the WE...

SAP Information Steward Cross-Site Scripting Execution Vulnerability

SAP Information Steward is a data management and integrity solution from SAP. The product supports data analysis, data along and metadata management and other functions. A cross-site scripting vulnerability exists in SAP Information Steward version 4.2. The vulnerability stems from a lack of prop...

min-http-server cross-site scripting vulnerability

min-http-server is a lightweight http static resource server . A cross-site scripting vulnerability exists in min-http-server all versions. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute...

cPanel cross-site scripting vulnerability (CNVD-2019-33871)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in cPanel. An attacker can exploit this vulnerability to execute client-side code...

http-file-server cross-site scripting vulnerability

http-file-server is an HTTP file server. A cross-site scripting vulnerability exists in http-file-server all versions. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute client-side code...

CVE-2019-4285

IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could send a specially-crafted HTTP request to hijack the victim's click actions or launch oth...

CentOS Web Panel Cross-Site Scripting Vulnerability

CentOS Web Panel CWP is a free web hosting control panel. A cross-site scripting vulnerability exists in the filemanager2.php file the 'fmcurrentdir' parameter in CWP version 0.9.8.846. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker can...

Ahsay Systems Cloud Backup Suite Cross-Site Scripting Vulnerability

Ahsay Systems Cloud Backup Suite is a cloud-based backup software suite from Ahsay Systems. A cross-site scripting vulnerability exists in the Alias field in Ahsay Systems Cloud Backup Suite versions prior to 8.1.1.50. The vulnerability stems from a lack of proper validation of client data by the...

Wikindx Cross-Site Scripting Vulnerability (CNVD-2020-22365)

Wikindx is a suite of virtual research environments online bibliography and quote/notes management and article creation system. A cross-site scripting vulnerability exists in Wikindx. The vulnerability stems from the WEB application lacking proper validation of client-side data. An attacker can...

WordPress Email Subscribers&Newsletters Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers&Newsletters is one of the plug-ins used to push news and information. A cross-site scripting vulnerability exists in...

Veeam ONE Reporter Cross-Site Scripting Vulnerability (CNVD-2019-24803)

Veeam ONE Reporter is part of the Veeam ONE integrated solution from Veeam Switzerland. The product is used for analytics, decision making, refunds, change tracking, capacity planning and resource utilization optimization. A cross-site scripting vulnerability exists in Veeam ONE Reporter version...

MISP Cross-Site Scripting Vulnerability (CNVD-2020-22366)

MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. MISP suffers from a cross-site scripting vulnerability. The vulnerability stems from a lac...

Veeam ONE Reporter Cross-Site Scripting Vulnerability

Veeam ONE Reporter is part of the Veeam ONE integrated solution from Veeam Switzerland. The product is used for analytics, decision making, refunds, change tracking, capacity planning and resource utilization optimization. A cross-site scripting vulnerability exists in Veeam ONE Reporter version...

Micro Focus ArcSight Security Management Center Cross-Site Scripting Vulnerability

Micro Focus ArcSight Security Management Center ArcMC is a suite of centralized security management centers from Micro Focus UK. The product focuses on managing ArcSight solutions through a single interface, including automated change management, log traffic management and other features. A...

GNUBOARD5 Cross-Site Scripting Vulnerability (CNVD-2019-24243)

GNUBOARD5 is a Web forum system based on PHP and MySQL. A cross-site scripting vulnerability exists in GNUBOARD5 version 5.3.1.9. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side...