Zoho ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-15667)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...

eZ Platform Admin UI Cross-Site Scripting Vulnerability

eZ Platform is an open source enterprise content management system CMS. admin UI is one of the back-end management interface . A cross-site scripting vulnerability exists in the Admin UI in eZ Platform version 2.x, which can be exploited by an attacker to execute client-side code...

Applaud HCM Cross-Site Scripting Vulnerability

Applaud HCM is a human resource management application. A cross-site scripting vulnerability exists in Applaud HCM version 4.0.42+ that can be exploited by an attacker to execute client-side code...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2019-25043)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

Design/Logic Flaw

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12098

CVE-2019-12098 affects Heimdal Kerberos 5 clients; the issue is failure to verify anonymous PKINIT KX (PA-PKINIT-KX) during the key exchange, enabling potential MITM. Public advisories indicate this was fixed in newer Heimdal releases (e.g., 7.6.0+ and later such as 7.7.0 in openSUSE/SUSE bundles...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

Seagate NAS OS Cross-Site Scripting Vulnerability

Seagate NAS OS is a NAS Network Attached Storage operating system from Seagate USA. A cross-site scripting vulnerability exists in the API error page in Seagate NAS OS version 4.3.15.1. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker cou...

IBM Rational DOORS Web Access Cross-Site Scripting Vulnerability (CNVD-2019-15711)

IBM Rational DOORS Web Access is a requirements collaboration solution from IBM USA. The product supports creating, analyzing, editing, and discussing requirements and other A cross-site scripting vulnerability exists in IBM Rational DOORS Web Access versions 9.5.1 through 9.5.2.9 and 9.6 through...

Simditor cross-site scripting vulnerability (CNVD-2019-14696)

Simditor is a browser-based WYSIWYG text editor. A cross-site scripting vulnerability exists in Simditor 2.3.21 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...

IPBRICK OS Cross-Site Scripting Vulnerability

IPBRICK OS is a Linux-based communication platform. The platform includes features such as document and process management, e-mail and collaboration tools. A cross-site scripting vulnerability exists in IPBRICK OS version 6.3. The vulnerability stems from a lack of proper validation of client dat...

WordPress AMP for WP Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in ampforwpsavestepsdata in WordPress AMP for WP plugin versions...

Typesetter Cross-Site Scripting Vulnerability

Typesetter is a content management system CMS. A cross-site scripting vulnerability exists in Typesetter version 5.1, which stems from a lack of proper validation of client-side data in the web application and can be exploited by an attacker to execute client-side code...

Evernote Cross-Site Scripting Vulnerability

Evernote Impression Notes is a suite of note-taking software for the macOS platform from the American company Evernote. The software creates, manages, synchronizes, searches and shares notes anytime, anywhere. A cross-site scripting vulnerability exists in Evernote version 6.15 Windows. The...

WordPress Kieran O'Shea Calendar Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Kieran O'Shea Calendar plugin prior to version 1.3.11. The...

Joomla! cross-site scripting vulnerability (CNVD-2019-15713)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A cross-site scripting vulnerability exists in versions of Joomla! prior to 3.9.6. The vulnerability stems from a lack of proper validation of...

Node.js third-party modules: [http_server] Stored XSS in the filename when directories listing

I would like to report Stored XSS in module "httpserver". It allows to inject malicious scripts in the file name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module - module name: httpserver - version: 1.0.12 - npm page:...

Vulnerabilities in financial mobile apps put consumers and businesses at risk

Security hubris. It’s the phrase we use to refer to our feeling of confidence grounded on assumptions we all have but may not be aware of or care to admit about cybersecurity—and, at times, privacy. It rears its ugly head when 1 we share the common notion that programmers know how to code securel...

Design/Logic Flaw

A log poisoning vulnerability has been discovered in the OneShield Policy Dragon Core framework before 5.1.10. Authenticated remote adversaries can poison log files by entering malicious payloads in either headers or form elements. These payloads are then executed via a client side debugging...