Advantech WebAccess/SCADA Cross-Site Scripting Vulnerability (CNVD-2021-59236)

Advantech WebAccess/SCADA is a set of SCADA software based on browser architecture from Advantech, Taiwan, China. A cross-site scripting vulnerability exists in Advantech WebAccess/SCADA, which originates from UserExcelOut.asp failing to properly validate the correctness of user data. The...

Chikitsa Patient Management System 跨站脚本漏洞

Chikitsa Patient Management System is a software application. An open source patient management software that is fast, responsive and easy to use. A security vulnerability exists in Chikitsa Patient Management System 2.0.0, which arises from a lack of proper validation of client-side data by the...

NavigateCMS 跨站脚本漏洞

NavigateCMS is a content management system. NavigateCMS 2.9 suffers from a cross-site scripting vulnerability that stems from the WEB application's lack of proper validation of client-side data. An attacker can exploit the vulnerability to execute client-side code...

Advantech WebAccess/SCADA 跨站脚本漏洞

Advantech WebAccess/SCADA is a set of SCADA software based on browser architecture from Advantech, Taiwan, China. A cross-site scripting vulnerability exists in Advantech WebAccess/SCADA, which originates from UserExcelOut.asp failing to properly validate the correctness of user data. The...

Pulse Secure Pulse Connect Secure 跨站脚本漏洞

Pulse Secure Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is an SSL VPN solution from Pulse Secure, Inc. in the United States. A cross-site scripting vulnerability exists in Pulse Secure Pulse Connect Secure that stems from the platform's failure to securely handle special...

IBM API Connect Cross-Site Scripting Vulnerability (CNVD-2021-88200)

IBM API Connect is an integrated solution for managing the API lifecycle from IBM USA. The product supports creating, running, managing and securing APIs, microservices and more. A cross-site scripting vulnerability exists in IBM API Connect. The vulnerability stems from the lack of proper...

DELL Dell EMC iDRAC9 Cross-Site Scripting Vulnerability (CNVD-2021-94891)

DELL Dell EMC iDRAC9 is a system management solution comprising hardware and software from Dell USA. The solution provides remote management, crash system recovery and power control for Dell PowerEdge systems. A cross-site scripting vulnerability exists in Dell EMC iDRAC9 in versions prior to...

DELL Dell EMC iDRAC9 跨站脚本漏洞

DELL Dell EMC iDRAC9 is a system management solution comprising hardware and software from Dell USA. The solution provides remote management, crash system recovery and power control for Dell PowerEdge systems. A cross-site scripting vulnerability exists in Dell EMC iDRAC9 in versions prior to...

IBM API Connect 跨站脚本漏洞

IBM API Connect is an integrated solution for managing the API lifecycle from IBM USA. The product supports creating, running, managing and securing APIs, microservices and more. A cross-site scripting vulnerability exists in IBM API Connect. The vulnerability stems from the lack of proper...

Telegram Cross-Site Scripting Vulnerability

Telegram is an instant messaging mobile application. version 0.6.1 of Telegram Web K Alpha is vulnerable to a cross-site scripting vulnerability that stems from the fact that Telegram Web K Alpha allows XSS to pass through document names. An attacker could exploit the vulnerability to execute...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin MyStickymenu, which stems from t...

Exploit for Cross-site Scripting in Gitea

CVE-2021-28378 Details about this CVE herehttps://www.cved...

CVE-2021-35193

Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across different customers' installations that have the same software version. This provides remote access to SQL database credentials. In the normal use of the product, retrieving those...

Default credentials

Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across different customers' installations that have the same software version. This provides remote access to SQL database credentials. In the normal use of the product, retrieving those...

Storing Encrypted Photos in Google’s Cloud

New paper: "Encrypted Cloud Photo Storage Using Google Photos": Abstract: Cloud photo services are widely used for persistent, convenient, and often free photo storage, which is especially useful for mobile devices. As users store more and more photos in the cloud, significant privacy concerns...

Telegram 跨站脚本漏洞

Telegram is an instant messaging mobile application. version 0.6.1 of Telegram Web K Alpha is vulnerable to a cross-site scripting vulnerability that stems from the fact that Telegram Web K Alpha allows XSS to pass through document names. An attacker could exploit the vulnerability to execute...

TideSec WDScanner 跨站脚本漏洞

WDScanner is an easy-to-use distributed web vulnerability detection system. version 1.1 of WDScanner has a cross-site scripting vulnerability in the system administration page, through which an attacker can execute client-side code...

WDScanner Cross-Site Scripting Vulnerability

WDScanner is an easy-to-use distributed web vulnerability detection system. version 1.1 of WDScanner has a cross-site scripting vulnerability in the system administration page, through which an attacker can execute client-side code...

WordPress Cross-site Request Forgery Vulnerability (CNVD-2021-59587)

WordPress is a set of blogging platforms developed by the WordPress Wordpress Foundation using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers.A cross-site request forgery vulnerability exists in the WooCommerce Stock Manager WordPress plugin,...

CVE-2021-36563

The CheckMK management web console versions 1.5.0 to 2.0.0 does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser such as JavaScript or other client-side scripts, the XSS...