CVE-2021-43355

The CVE-2021-43355 entry concerns Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) v2.0.1.3, where client-side input validation is performed without server-side authentication, allowing a user to bypass checks and login with service privileges. The root cause is misuse of client-side ...

CVE-2021-23196 Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentials

The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side and does not protect authentication attributes sufficiently...

pimcore Cross-Site Scripting Vulnerability (CNVD-2022-07500)

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce frameworks and product information management applications.Pimcore has cross-site scripting...

Saraban Cross-Site Scripting Vulnerability

Saraban is a document management system from Softvibe Thailand. It is used for transferring files and notifications to reduce unnecessary duplication.SARABAN has a cross-site scripting vulnerability in version 1.1, which stems from the lack of data validation filtering of user-supplied data and...

Pimcore 跨站脚本漏洞

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce frameworks and product information management applications. pimcore has a cross-site scripting...

chaskiq Cross-Site Scripting Vulnerability (CNVD-2022-08227)

Chaskiq is an open source messaging platform. It is used for marketing, support and sales. chaskiq suffers from a cross-site scripting vulnerability that stems from the fact that chaskiq is vulnerable to input errors during web page generation "cross-site scripting". An attacker could exploit thi...

Microweber 跨站脚本漏洞

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in microweber, which stems from a lack of data...

BigBlueButton 跨站脚本漏洞

BigBlueButton is an open source web conferencing system from the BigBlueButton Bigbluebutton community. bigbluebutton suffers from a cross-site scripting vulnerability that stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerabilit...

Affiliate Pro 1.7 - (Multiple) Cross Site Scripting Vulnerability

Exploit Title: Affiliate Pro 1.7 - 'Multiple' Cross Site Scripting XSS Document Title: =============== Affiliate Pro v1.7 - Multiple Cross Site Vulnerabilities Product & Service Introduction: =============================== Affiliate Pro is a Powerful and yet simple to use PHP affiliate Managemen...

UK Government to Launch PR Campaign Undermining End-to-End Encryption

Rolling Stone is reporting that the UK government has hired the M&C Saatchi advertising agency to launch an anti-encryption advertising campaign. Presumably theyll lean heavily on the "think of the children!" rhetoric were seeing in this current wave of the crypto wars. The technical eavesdroppin...

WordPress WP Booking System plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress WP Booking System plugin has a cross-site scripting vulnerability in versions prior to 2.0.15...

Pimcore 跨站脚本漏洞

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications. pimcore has a cross-site scripting...

Halo cross-site scripting vulnerability (CNVD-2022-08209)

Halo is a personal blogging system for individual developers. Halo suffers from a cross-site scripting vulnerability, which stems from the lack of proper validation of client-side data in the WEB application, and can be exploited by an attacker to execute client-side code...

Chaskiq 跨站脚本漏洞

Chaskiq is an open source messaging platform. It is used for marketing, support and sales. chaskiq suffers from a cross-site scripting vulnerability that stems from the fact that chaskiq is vulnerable to input errors during web page generation "cross-site scripting". An attacker could exploit thi...

Chaskiq 跨站脚本漏洞

Chaskiq is an open source messaging platform. Used for marketing, support and sales. Chaskiq suffers from a cross-site scripting vulnerability that stems from a lack of data checksum filtering of user-supplied data and output. An attacker can exploit the vulnerability to execute JavaScript code o...

Reprise Software Reprise License Manager Cross-Site Scripting Vulnerability

Reprise Software Reprise License Manager is a software licensing toolkit from Reprise Software, Inc. that provides local and cloud-based license management, license enforcement and product activation solutions for publishers of commercial software applications.Reprise Software Reprise License...

AgentTesla Builder Web Panel Cross Site Scripting Vulnerability

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/db9629508fda139f71f625d764c7eff7.txt Contact: email protected Media: twitter.com/malvuln Threat: AgentTesla Builder Web Panel Vulnerability: Cross Site Scripting XSS Description: AgentTeslaBuilder WebU...

in livehelperchat/livehelperchat

Lack of server side validation An admin can delete his/her account by bypassing client side validation 1.Login in application as admin. 2.Nagiate to settings and create another user. 3.Now see the list of user, an admin can only delete other user account rather than his/her. 4.Click on delete and...

Jenkins Badge Plugin Cross-Site Scripting Vulnerability

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . Jenkins Badge Plugin in version 1.9 and earlier suffers from a cross-site scripting vulnerability that stems from a lac...

IBM Security Verify Access Cross-Site Scripting Vulnerability

IBM Security Verify Access is a service from IBM USA that improves user access security. The service enables secure and simple access to platforms such as Web, mobile, IoT, and cloud technologies through the use of risk-based access, single sign-on, integrated access management controls, identity...