Apache Atlas CVE-2019-10070 HTML Injection Vulnerability

Description Apache Atlas is prone to an HTML injection vulnerability because it fails to sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

Shopify: XSS on product comments in transfers

summery: You are able to copy and paste stored XSS code into the comment section of a product in the transfers tab and receive the error. Reproduce: 1. Create a product with the name '"'' 2. add a transfer with that product 3. now go back to the product use the code button and type the same code...

Raritan CommandCenter Secure Gateway Cross Site Scripting

I. VULNERABILITY ------------------------- XSS Vulnerability on Raritan CommandCenter Secure Gateway II. CVE REFERENCE ------------------------- - III. VENDOR ------------------------- https://www.raritan.com/support/product/commandcenter-secure-gateway IV. TIMELINE -------------------------...

XSS Vulnerability in the Frontend of the Kaixin Helpdesk System

The Kaixin Helpdesk Helpdesk helps IT to collect the problems handled on a daily basis and generate reports to quantify the work. An XSS vulnerability exists in the frontend of the Qixing Helpdesk system, which can be exploited by attackers to obtain administrator cookie information...

Stored Cross-site Scripting Vulnerability in Xionghai CMS Frontend Message Board Comments

Xionghai CMS is a set of comprehensive website management system that can be widely used in personal blogs, personal websites and corporate websites. Applicable to personal blogs, personal websites, corporate websites and other various purposes, the front end of the computer, mobile two display...

XSS Vulnerability in ED01-CMS

ED01-CMS is a content management system and the CMS project of Edwin Diaz's Udemy course "PHP for Beginners - Become a PHP Master". An XSS vulnerability exists in the ED01-CMS content management system, which can be exploited by attackers to obtain sensitive information such as cookies...

Zyxel NBG-418N v2 Modem Cross-Site Request Forgery Vulnerability

The Zyxel NBG-418N is a broadband router. The Zyxel NBG-418N v2 Modem suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to execute arbitrary script code in the context of an affected site to steal cookie-based authentication credentials or perform...

bootstrap: XSS in the affix configuration target property

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the affix configuration target property. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hostin...

CVE-2019-17104

In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set...

Stored Cross-Site Scripting Vulnerability in QCMS Website Management System Before and After

QCMS website management system is a PHP lightweight system developed through MVC architecture. A stored cross-site scripting vulnerability exists before and after the QCMS website management system. An attacker can insert malicious js code into a page to obtain user cookies and other information,...

XSS vulnerability in Guojiz URL navigation system (CNVD-2019-35041)

Guojiz website navigation system is a navigation website source code system developed by PHP+MySQL. Guojiz navigation system XSS vulnerability, an attacker can exploit the vulnerability to obtain background user cookie information...

CVE-2019-16238

Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login...

XSS Vulnerability in JC Retail Management Information System JC RMIS Frontend

Ongie is an innovative enterprise that provides fully integrated information system solutions and cloud services for retail enterprises with software development as its core, and is a full-service, integrated solution provider for the retail industry in China. JC Retail Management Information...

XSS Vulnerability in Receiving Address Field of E-commerce System of Kunming Aoyuan Technology Co.

Kunming Aoyuan Technology Co., Ltd. is a high-tech enterprise engaged in system development, website construction and other Internet businesses. There is an XSS vulnerability in the receiving address field of the e-commerce system of Kunming Aoyuan Technology Co. Ltd, which can be exploited by...

Stored Cross-Site Scripting Vulnerability in RiverHub Technology Mall System

Shenyang Hehan Technology Co., Ltd. is a group company that provides online marketing services to customers. A stored cross-site scripting vulnerability exists in the RiverHan Technology Mall system. Attackers can insert malicious js code in the page to obtain user cookies and other information,...

Stored cross-site scripting vulnerability in DedeCMS ed***_sp***_in***.php page

Dream Content Management System DedeCMS is a PHP open source website management system. A stored cross-site scripting vulnerability exists in the DedeCMS edspin.php page. An attacker can insert malicious js code into the page to obtain user cookies and other information, leading to user hijacking...

CVE-2019-15227

FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions...

Design/Logic Flaw

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible...

CVE-2019-14547

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the...

CVE-2019-14546

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was inserted inside the Email Signature in the Preference page. The attacker could insert malicious JavaScript inside his email signature, whi...