Design/Logic Flaw

An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to store malicious JavaScript code in the task description. This is later executed when it is reflected back to the user...

Cross site scripting

An issue was discovered in COINS Construction Cloud 11.12. Due to an inappropriate use of HTML IFRAME elements, the file upload functionality is vulnerable to a persistent Cross-Site Scripting XSS attack...

CVE-2021-45227

An issue was discovered in COINS Construction Cloud 11.12. Due to an inappropriate use of HTML IFRAME elements, the file upload functionality is vulnerable to a persistent Cross-Site Scripting XSS attack...

CVE-2021-45227

COINS Construction Cloud 11.12 contains a persistent Cross-Site Scripting (XSS) flaw in the file upload flow due to inappropriate handling of HTML IFRAME elements. Root cause: improper IFRAME usage during uploads enables script persistence. Impact is documented as client-side compromise; CVSS sco...

CVE-2021-45228

An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to store malicious JavaScript code in the task description. This is later executed when it is reflected back to the user...

CVE-2021-45228

CVE-2021-45228 is an XSS vulnerability in COINS Construction Cloud 11.12. The issue stems from insufficient neutralization of user input in the description of a task, allowing stored malicious JavaScript which is later reflected back to users. Affected source describes that the vulnerability can ...

COINS Construction Cloud 跨站脚本漏洞

COINS Construction Cloud is an end-to-end suite of cloud and mobile software solutions from COINS, Inc. designed to help construction executives drive increased profitability across their business. A cross-site scripting vulnerability exists in COINS Construction Cloud 11.12 that stems from...

COINS Construction Cloud 跨站脚本漏洞

COINS Construction Cloud is an end-to-end suite of cloud and mobile software solutions from COINS, Inc. designed to help construction executives drive increased profitability across their business. A cross-site scripting vulnerability exists in COINS Construction Cloud version 11.12, which stems...

CVE-2021-45227: Improper Neutralization of Input During Web Page Generation

An issue was discovered in COINS Construction Cloud 11.12. Due to an inappropriate use of HTML IFRAME elements, the file upload functionality is vulnerable to a persistent Cross-Site Scripting XSS attack...

PT-2022-12313

Name of the Vulnerable Software and Affected Versions COINS Construction Cloud version 11.12 Description An issue was discovered due to insufficient neutralization of user input in the description of a task, allowing malicious JavaScript code to be stored and later executed when reflected back to...

PT-2022-12312

Name of the Vulnerable Software and Affected Versions COINS Construction Cloud version 11.12 Description The issue is related to an inappropriate use of HTML IFRAME elements in the file upload functionality, making it vulnerable to a persistent Cross-Site Scripting XSS attack. This allows for...

CVE-2021-45228: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to store malicious JavaScript code in the task description. This is later executed when it is reflected back to the user...

Microsoft Graphics Components输入验证错误漏洞

A remote code execution vulnerability exists in Microsoft Windows Graphics Components, which originates when a network system or product fails to properly filter external input data during the construction of code segments. elements during the construction of code segments from external input dat...

Design/Logic Flaw

AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that ca...

Tenda M3 Command Injection Vulnerability (CNVD-2022-33119)

Tenda M3 is an access control from Tenda, China. Tenda M3 is vulnerable to command injection, which stems from the failure of the component /goform/SetInternetLanInfo to properly filter the construction of command special characters, commands, etc. An attacker could use this vulnerability to caus...

New Backdoor Targets French Entities via Open-Source Package Installer

Researchers have exposed a new targeted email campaign aimed at French entities in the construction, real estate, and government sectors that leverages the Chocolatey Windows package manager to deliver a backdoor called Serpent on compromised systems. Enterprise security firm Proofpoint attribute...

modularhomes.construction Cross Site Scripting vulnerability OBB-2387800

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Under Construction plugin <= 3.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Under Construction plugin versions = 3.0. Solution Update the WordPress Under Construction plugin to the latest available version at least 4.0...

WordPress Under Construction plugin <= 3.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Under Construction plugin versions = 3.0. Solution Update the WordPress Under Construction plugin to the latest available version at least 4.0...

offsiteconstructionexpo.com Cross Site Scripting vulnerability OBB-2367185

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...