XooNIps Cross-Site Scripting Vulnerability (CNVD-2020-63192)

XooNIps is a content management system for the field of neuroscience by the XooNIps team in Japan. A cross-site scripting vulnerability exists in XooNIps version 3.49 and prior versions, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can explo...

PT-2020-4864 · Microsoft · Windows Client Side Rendering Print Provider +1

Name of the Vulnerable Software and Affected Versions: Windows Client Side Rendering Print Provider affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Client Side Rendering Print Provider component of the Windows operating system...

KB4586785: Windows 10 Version 1803 November 2020 Security Update

The Microsoft 4586785 Product is missing security updates. - Remote Desktop Protocol Server Information Disclosure Vulnerability CVE-2020-16997 - DirectX Elevation of Privilege Vulnerability CVE-2020-16998 - Windows WalletService Information Disclosure Vulnerability CVE-2020-16999 - Remote Deskto...

KB4586787: Windows 10 November 2020 Security Update

The Microsoft 4586787 Product is missing security updates. - Remote Desktop Protocol Server Information Disclosure Vulnerability CVE-2020-16997 - DirectX Elevation of Privilege Vulnerability CVE-2020-16998 - Windows WalletService Information Disclosure Vulnerability CVE-2020-16999 - Remote Deskto...

QNAP Systems TS-870 Cross-Site Scripting Vulnerability

QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site scripting vulnerability exists in PhotoStation Filenames in the QNAP Systems TS-870 using firmware version 4.3.4.0486. The vulnerability stems from a lack of proper validation of client...

QNAP Systems TS-870 Cross-Site Scripting Vulnerability

QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site scripting vulnerability exists in the File Name of Music Station in the QNAP Systems TS-870 using firmware version 4.3.4.0486. The vulnerability stems from a lack of proper validation of...

CVE-2020-28250

Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi because authentication is on the client side...

CVE-2020-28250

Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi because authentication is on the client side...

Authentication flaw

Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi because authentication is on the client side...

httpd: mod_rewrite potential open redirect

A vulnerability was discovered in Apache httpd, in modrewrite. Certain self-referential modrewrite rules could be fooled by encoded newlines, causing them to redirect to an unexpected location. An attacker could abuse this flaw in a phishing attack or as part of a client-side attack on browsers...

httpd: limited cross-site scripting in mod_proxy error page

A cross-site scripting vulnerability was found in Apache httpd, affecting the modproxy error page. Under certain circumstances, a crafted link could inject content into the HTML displayed in the error page, potentially leading to client-side exploitation...

WordPress Greenmart theme cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Greenmart theme version 2.4.2, which originates in th...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2020-60334)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in OX App Suite version 7.10.3 and prior versions, which stems from a la...

Basecamp: a very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of service

Summary : ========= after trying to change my initial name to something long i found out that their are no limits to how long it can be , so i directly changed it to something very long F1050497 which caused my account to really slow down when accessing it and in the android app , it just keeps...

Code injection

In BigBlueButton before 2.2.28 or earlier, the client-side Mute button only signifies that the server should stop accepting audio data from the client. It does not directly configure the client to stop sending audio data to the server, and thus a modified server could store the audio data and/or...

CVE-2020-27607

CVE-2020-27607 affects BigBlueButton before 2.2.28. The client-side Mute button does not directly stop sending audio; it only signals the server to stop accepting audio data. A modified server could store audio data and/or transmit it to participants or third parties. Affected component: client-s...

CloudBees Jenkins Radiator View Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

WordPress Plugin HS Brand Logo Slider 2.1 - 'logoupload' File Upload

Exploit Title: WordPress Plugin HS Brand Logo Slider 2.1 - 'logoupload' File Upload Date: 2020-10-20 Exploit Author: Net-Hunter Google Dork: N/A Software Link: https://ms.wordpress.org/plugins/hs-brand-logo-slider/ Vendor Homepage: https://www.heliossolutions.co/ Tested on: Linux Apache / Wordpre...

Windows Media redirection fails on Citrix Workspace app for Mac

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Attempts to use Windows Media Redirection might fail even after choosing to be Allowed in theWindows...

OLIMPOKS Cross-Site Scripting Vulnerability

OLIMPOKS is a mobile device application for vocational training from olimpoks Russia. The application offers provides the opportunity to conduct training in industrial safety certified areas approved by Rostekhnadzor, labor protection, labor protection, civil defense and emergency situations on...