Micro Focus ArcSight Logger Cross-Site Scripting Vulnerability

Micro Focus ArcSight Logger is a suite of log management software from Micro Focus UK. The software collects and integrates data from any log generation source for log management, searching, indexing, reporting, analysis and retention. A cross-site scripting vulnerability exists in ArcSight Logge...

WordPress WebAppick WooCommerce Product Feed Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WebAppick WooCommerce Product Feed is a plugin used in WordPress to generate product feed data. A cross-site scripting...

Frog CMS Cross-Site Scripting Vulnerability (CNVD-2019-23999)

Frog CMS is a Content Management System CMS developed by Philippe Archambault Software Developers. The system provides tools for page templates, user rights management and document management. A cross-site scripting vulnerability exists in Snippets in Frog CMS version 1.1. The vulnerability stems...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30775)

Firefly III is an open source personal financial management system. A cross-site scripting vulnerability exists in Firefly III versions prior to 4.7.17.3, which can be exploited by an attacker to execute client-side code...

Cross-Site Scripting Vulnerability in Multiple AudioCodes Products

AudioCodes Mediant 500L-MSBR and so on are products of AudioCodes Israel.AudioCodes Mediant 500L-MSBR is a 500L series all-in-one SOHO/SMB router.AudioCodes Mediant 500-MSBR is a 500 The AudioCodes Mediant 500-MSBR is a 500L series all-in-one SOHO/SMB router. A cross-site scripting vulnerability...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2019-29581)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in Mozilla Firefox versions prior to 68. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can...

WordPress CampTix Event Ticketing Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.CampTix Event Ticketing is a ticketing system plugin used in it. WordPress CampTix Event Ticketing has a cross-site scripting...

MicroStrategy Web Cross-Site Scripting Vulnerability (CNVD-2019-23751)

Microstrategy Web is a set of U.S. Microstrategy's enterprise data analysis platform. The platform features data discovery, data visualization and report generation. A cross-site scripting vulnerability exists in the 'FLTB' parameter in MicroStrategy Web versions prior to 10.1 patch 10. The...

EspoCRM Cross-Site Scripting Vulnerability (CNVD-2019-30787)

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM versions prior to 5.6.4, which can be exploited by remote attackers to...

HexoEditor Cross-Site Scripting Vulnerability

HexoEditor is an open source for Hexo blogging framework has been optimized for Markdown a markup language that can be written using a regular text editor editor. A cross-site scripting vulnerability exists in HexoEditor v1.1.8-beta. The vulnerability stems from a lack of proper validation of...

Zammad Cross-Site Scripting Vulnerability (CNVD-2019-23066)

Zammad is a suite of ticket management software from the German company Zammad. A cross-site scripting vulnerability exists in Zammad 2.3.0 and prior versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this...

WordPress Appointment Hour Booking Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Appointment Hour Booking plugin is an online booking plugin used in it. A cross-site scripting vulnerability exists in WordPress...

Teclib GLPI Cross-Site Scripting Vulnerability

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A cross-site scripting vulnerability exists in the...

Apache Roller Cross-Site Scripting Vulnerability (CNVD-2019-23302)

Apache Roller is the U.S. Apache Apache Software Foundation's set of Java-based multi-user open source blogging system. A cross-site scripting vulnerability exists in Apache Roller versions 5.2.2, 5.2.1 and 5.2. The vulnerability stems from the WEB application's lack of proper validation of...

Leanote cross-site scripting vulnerability (CNVD-2019-22606)

Leanote is an open source notepad application. A cross-site scripting vulnerability exists in versions prior to Leanote 2.6. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute client-side code...

Tenda D301 Cross-Site Scripting Vulnerability

Tenda D301 is a wireless router from Tenda China. A cross-site scripting vulnerability exists in Tenda D301 v2. The vulnerability stems from the lack of proper validation of client data by a web application. An attacker can exploit this vulnerability to execute client-side code...

Nagios XI Cross-Site Scripting Vulnerability (CNVD-2019-23522)

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A cross-site scripting vulnerability exists in the Auto-Login administrator management page in Nagios XI...

Trape Cross-Site Scripting Vulnerability (CNVD-2019-22229)

Trape is a suite of open source Internet tracking and identification tools. The tool is capable of remotely identifying sessions and simulating phishing attacks. A cross-site scripting vulnerability exists in the static/js/trape.js file in Trape 2019-05-08 and earlier versions. The vulnerability...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2019-30620)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in the AFM feed list in the F5 BIG-IP AFM and ASM, which can be exploited by an...

Trint Ltd: Insecure Zendesk SSO implementation by generating JWT client-side

Summary: app.trint.com implements SSO to Zendesk, it does this by using JWT as described at https://support.zendesk.com/hc/en-us/articles/203663816-Enabling-JWT-JSON-Web-Token-single-sign-on This functionality has not been implemented securely because the JWT generation happens in the client-side...