GitLab: XSS on Issue reference numbers

Dear team, I found an XSS that occurs when users move mouse over reference numbers of issues. This XSS occurs on Firefox. It does not occurs on Webkit-based ones such as Safari, Chrome. I haven't tested on Edge. It can be also occured in older browsers due to svg4everybody and...

LeptonCMS Cross-Site Scripting Vulnerability

LeptonCMS is an easy to use content management system with integrated jquery library for freelance designers, php developers and web agents. LeptonCMS suffers from a cross-site scripting vulnerability that stems from a lack of proper validation of client-side data by the web application. An...

CloudBees Jenkins and LTS Cross-Site Scripting Vulnerability (CNVD-2020-20708)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

CloudBees Jenkins and LTS Cross-Site Scripting Vulnerability (CNVD-2020-20707)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

CloudBees Jenkins RapidDeploy plugin cross-site scripting vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . RapidDeploy Plugin is used in one of the...

Micro Focus Vibe Cross-Site Scripting Vulnerability

Micro Focus Vibe is a team collaboration management solution from Micro Focus UK. The solution has features such as file sharing, building dynamic forms and workflows. A cross-site scripting vulnerability exists in Micro Focus Vibe versions prior to 4.0.7. The vulnerability stems from the WEB...

The vulnerability of the CSC Service in Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the CSC Service for Windows operating systems is related to incorrect handling of objects in memory. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

Nagios XI Cross-Site Scripting Vulnerability (CNVD-2020-19533)

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A cross-site scripting vulnerability exists in Nagios XI version 5.6.11. The vulnerability stems from the...

RainLoop Webmail Cross-Site Scripting Vulnerability

RainLoop Webmail is a web-based e-mail client software. A cross-site scripting vulnerability exists in RainLoop Webmail versions prior to 1.13.0, which stems from the lack of proper validation of client-side data by the web application and can be exploited by an attacker to execute client-side co...

pki-core cross-site scripting vulnerability (CNVD-2020-27182)

pki-core is a library that provides an API for PKI operations. A cross-site scripting vulnerability exists in pki-core. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

WordPress Simple Link Directory Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Simple Link Directory is a directory plugin used in it. A cross-site scripting vulnerability exists in the qcopd-shortcode-generator.ph...

Qulture.Rocks: Unrestricted File Upload in Chat Window

Summary: The application allows the attacker to upload dangerous file types that can be automatically processed within the product's environment. Steps To Reproduce: 1. Hit the browser with below URL. https://qa.qulture.rocks/en/users/signin 2. Open The Cat window. 3. Upload any exe file . 4. Cli...

NETSAS Enigma NMS Cross-Site Scripting Vulnerability

NETSAS Enigma NMS is a suite of network management and monitoring tools from NETSAS Australia. A cross-site scripting vulnerability exists in NETSAS Enigma NMS version 65.0.0 and earlier. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An...

ERPNext cross-site scripting vulnerability (CNVD-2020-19000)

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-22261)

Ignite Realtime Openfire is the Ignite Realtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open source real-time collaboration RTC server , it can build a highly efficient instant messaging server , and supports tens of...

ERPNext cross-site scripting vulnerability (CNVD-2020-19004)

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...

ERPNext cross-site scripting vulnerability (CNVD-2020-19002)

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...

ERPNext cross-site scripting vulnerability (CNVD-2020-19003)

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...

Canon Oce Colorwave 500 cross-site scripting vulnerability (CNVD-2020-18988)

The Canon Oce Colorwave 500 is a printer from Canon Japan. A cross-site scripting vulnerability exists in the 'settingId' parameter of the settingDialogContent.jsp page of the web application in Canon Oce Colorwave 500 version 4.0.0.0. The vulnerability stems from a lack of proper validation of...

ilchCMS Cross-Site Scripting Vulnerability (CNVD-2020-19203)

ilch CMS is a content management system that provides a basic system that is easily extensible. A cross-site scripting vulnerability exists in ilchCMS, which can be exploited by an attacker to execute client-side code...