Authentication Vulnerability in Coremail Mail System Server Side

Coremail mail system developed by Ying Shi Information Technology Co., Ltd. is a web application system, widely used in government agencies, enterprises and institutions and other departments. There is an authentication vulnerability in the server side of Coremail mail system. Because the server...

SAP Console HTML Injection Vulnerability

SAP Console is a set of distribution components from SAP that supports the connection of exchange information within the SAP system. An html injection vulnerability exists in SAP Hybris Management Console version 5.6. An attacker could exploit this vulnerability to execute arbitrary script code i...

S9Y Serendipity Cross-Site Scripting Vulnerability

Serendipity is a PHP-based blogging system. The system supports the creation of online journals, blogs, web pages and more. Cross-site scripting vulnerabilities exist in the serendipitybody parameter of the serendipityadmin.php page in S9Y Serendipity 2.0.4 and prior versions, due to the program...

HP Business Service Management Cross-Site Scripting Vulnerability

HP Business Service Management Business Service Management software that dynamically connects IT services to the underlying IT infrastructure with a business focus. A cross-site scripting vulnerability exists in HP Business Service Management. An attacker could exploit this issue to execute...

Foreman HTML Injection Vulnerability (CNVD-2016-10271)

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. An HTML injection vulnerability exists in Foreman, which arises from the program's failure to adequately...

Cisco Prime Collaboration Provisioning Cross-Site Scripting Vulnerability

Cisco Prime Collaboration Provisioning is a Web-based, next-generation communications services solution from Cisco. The solution provides IP communication services capabilities for IP telephony, voicemail, and unified communications environments. Cisco Prime Collaboration Provisioning suffers fro...

Cloudera HUE HTML Injection Vulnerability

Cloudera Hue is an open source Apache Hadoop UI system from the U.S. company Cloudera. Cloudera HUE suffers from an HTML injection vulnerability. An attacker can exploit the vulnerability to steal cookie-based authentication and execute arbitrary HTML or script code...

Drupal Elysia Cron Module Cross-Site Scripting Vulnerability

Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP language , Elysia Cron is one of the cron job management module . A cross-site scripting vulnerability exists in several versions of Elysia Cron, which can be exploited by attackers ...

Cloudera Manager has multiple vulnerabilities

Cloudera Manager is a set of Hadoop data management software from Cloudera, USA. The software supports the creation of clusters, authentication, data backup and recovery and so on. Cloudera Manager suffers from HTML injection and cross-site scripting vulnerabilities. An attacker exploiting the...

openstack-manila-ui: persistent XSS in metadata field

A cross-site scripting flaw was discovered in openstack-manila-ui's Metadata field contained in its "Create Share" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the "Shares" overview. Remote, authenticated, but unprivileged users could exploit this...

Nextcloud Server Content Spoofing Vulnerability

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has a content spoofing vulnerability in the "dav" app. The vulnerability is caused by displaying an abnormal message on the endpoint that puts input under the...

Nextcloud Server Content Spoofing Vulnerability (CNVD-2016-10259)

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has a content spoofing vulnerability in the "files" app. The vulnerability is caused by displaying an abnormal message on the endpoint that puts inputs under the...

Zenbership has multiple vulnerabilities

Zenbership is an open source customer relationship management platform. All versions of Zenbership suffer from a cross-site scripting vulnerability and a cross-site request forgery vulnerability that can be exploited by an attacker to steal cookie-based authentication or inject malicious scripts...

Magento CMS Invitations Feature HTML Injection Vulnerability

Magento CMS is the United States Magento company's set of open source PHP e-commerce content management system CMS. An HTML injection vulnerability exists in Magento CMS due to failure to adequately filter user input data. An attacker could exploit this vulnerability to execute arbitrary script...

SAP NetWeaver ABAP Cross-Site Scripting Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A cross-site scripting vulnerability exists in SAP NetWeaver ABAP due to a failure to adequately filter user...

Magento CMS URL Handling Cross-Site Scripting Vulnerability

Magento CMS is the United States Magento company's set of open source PHP e-commerce content management system CMS. A cross-site scripting vulnerability exists in Magento CMS due to failure to adequately filter user input data. An attacker could exploit this vulnerability by executing arbitrary...

Magento CMS Categories Management Cross-Site Scripting Vulnerability

Magento CMS is the United States Magento company's set of open source PHP e-commerce content management system CMS. A cross-site scripting vulnerability exists in Magento CMS due to failure to adequately filter user input data. An attacker could exploit this vulnerability by executing arbitrary...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2016-09992)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange AppSuite due to a failu...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2016-09993)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange AppSuite due to a failu...

Cross-site Scripting Vulnerability in metinfo Enterprise Website Builder System

MetInfo enterprise website management system using PHP + Mysql architecture, the whole station built-in SEO search engine optimization mechanism. MetInfo enterprise website management system background storage type cross-site scripting vulnerabilities, attackers can use the vulnerability to inser...