experianhealthproductdashboard.com Improper Access Control vulnerability

Security Researcher geeknik Helped patch 8584 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting experianhealthproductdashboard.com website and its users...

EnergyCAP Elevation of Privilege Vulnerability

EnergyCAP is a suite of energy management and utility accounting software from EnergyCAP USA. The software is primarily used to track, manage, process, report, benchmark and analyze utility bills and energy and sustainability information. An elevation of privilege vulnerability exists in EnergyCA...

CVE-2019-18623

Escalation of privileges in EnergyCAP 7 through 7.5.6 allows an attacker to access data. If an unauthenticated user clicks on a link on the public dashboard, the resource opens in EnergyCAP with access rights matching the user who created the dashboard...

CVE-2019-18623

Escalation of privileges in EnergyCAP 7 through 7.5.6 allows an attacker to access data. If an unauthenticated user clicks on a link on the public dashboard, the resource opens in EnergyCAP with access rights matching the user who created the dashboard...

Western Digital SSD Dashboard and SanDisk SSD Dashboard Input Validation Error Vulnerability

Western Digital SSD Dashboard and SanDisk SSD Dashboard are both products of Western Digital, Inc. Western Digital SSD Dashboard is a dashboard software for managing and monitoring SSD Solid State Drive devices. SanDisk SSD Dashboard is a dashboard software for managing and monitoring SanDisk SSD...

CVE-2019-18623: Improper Privilege Management

Escalation of privileges in EnergyCAP 7 through 7.5.6 allows an attacker to access data. If an unauthenticated user clicks on a link on the public dashboard, the resource opens in EnergyCAP with access rights matching the user who created the dashboard...

PT-2019-15540

Name of the Vulnerable Software and Affected Versions EnergyCAP versions 7 through 7.5.6 Description The issue allows for escalation of privileges, enabling an attacker to access data. This occurs when an unauthenticated user clicks on a link on the public dashboard, causing the resource to open ...

CVE-2019-8152

A stored cross-site scripting XSS vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective function and inject malicious javascript ...

CVE-2019-8152

A stored cross-site scripting XSS vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective function and inject malicious javascript ...

Cross site scripting

A stored cross-site scripting XSS vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective function and inject malicious javascript ...

CVE-2019-8152

A stored cross-site scripting XSS vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective function and inject malicious javascript ...

CVE-2019-8152

Magento 1: stored XSS via wysiwyg blockDirective() in admin cache affects 1.x before 1.9.4.3 and 1.14.4.3; Magento 2: affected if below 2.2.10 (2.2) or below 2.3.3 (2.3) or 2.3.2-p1. Authenticated user with wysiwyg editor access can inject JavaScript into the admin dashboard cache. Mitigation/pat...

CVE-2019-8152: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective function and inject malicious javascript ...

PT-2019-18928

Name of the Vulnerable Software and Affected Versions Magento 1 versions prior to 1.9.4.3 Magento 1 versions prior to 1.14.4.3 Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 Magento 2.3 versions prior to 2.3.2-p1 Description A stored cross-site scripting XSS issue exists...

ezXSS - An Easy Way For Penetration Testers And Bug Bounty Hunters To Test (Blind) Cross Site Scripting

ezXSS is an easy way for penetration testers and bug bounty hunters to test blind Cross Site Scripting. Current features Some features ezXSS has Easy to use dashboard with statics, payloads, view/share/search reports and more Payload generator Instant email alert on payload Custom javascript...

Zomato: [www.zomato.com] Blind XSS on one of the Admin Dashboard

Thanks for the report @pandaaaa. The Blind XSS fired when the order details were viewed by the admin at the back-end, The script was injected through an API endpoint from the Zomato app on one of the parameters which was recently introduced to provide special instructions to the restaurant on how...

@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.0.4), @telligro/opal-setup (>=0.3.0, <=0.3.1) +4 more potentially affected by CVE-2019-10756 via node-red-dashboard (>=2.3.11, <=2.15.0)

node-red-dashboard NPM version =2.3.11, =0.0.1, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2019-10756 Source advisory: OSV:GHSA-XG59-M7WX-853Q...

GHSA-XG59-M7WX-853Q Cross-site Scripting in node-red-dashboard

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

SUSE SLED15 / SLES15 Security Update : ceph, ceph-iscsi, ses-manual_en (SUSE-SU-2019:2736-1)

This update for ceph, ceph-iscsi and ses-manualen fixes the following issues : Security issues fixed : CVE-2019-10222: Fixed RGW crash caused by unauthenticated clients. bsc1145093 Non-security issues-fixed: ceph-volume: prints errors to stdout with --format json bsc1132767 mgr/dashboard: Changin...

Missing permission check in dynatrace-dashboard

dynatrace-dashboard does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password. As of publication of this advisory,...