EMS Master Calendar < 8.0.0.20180520 - Cross-Site Scripting

Exploit Title: EMS Master Calendar alert'XSS'xyz...

EMS Master Calendar 8.0.0.20180520 - Cross-Site Scripting

EMS Master Calendar 8.0.0.20180520 - Cross-Site Scripting Exploit Title: EMS Master Calendar alert'XSS'xyz...

CVE-2018-11628

Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS...

CVE-2018-11628

EMS Master Calendar before 8.0.0.201805210 is affected by a cross-site scripting (XSS) vulnerability where data input via URL parameters is not properly sanitized. Root cause: insufficient input filtering in the web application, enabling a crafted URL to execute script in a user’s browser. Docume...

USN-3543-1: rsync vulnerabilities

It was discovered that rsync incorrectly handled certain data input. An attacker could possibly use this to cause a denial of service or execute arbitrary code. CVE-2017-16548 It was discovered that rsync incorrectly parsed certain arguments. An attacker could possibly use this to bypass argument...

PHPSHE open source mall system order.php page exists out of rights access vulnerability

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. PHPSHE open source mall system order.php page ther...

Legal Robot: No length limit in invite_code can cause server degradation

Hi Team, I get to know that in every field is secured by restricted limit by length, but, i can see that one place where you forget to add that security feature , which can cause server degradation. https://app.legalrobot-uat.com/dmca-safe-harbor Here, i can see feature to add invite-code , but i...

Linux heap overflow of Fastbin Attack examples detailed explanation-vulnerability warning-the black bar safety net

1. Summary In recent years the large CTF game, see a lot of times pwn the category title appears in the fastbin attack of the case, such as this year's defcon, the RCTF, the fat Hubble Cup, 0CTF final, etc., fastbin attack is a heap exploits are common, easy-to-use and effective attack, in the...

dedeCMS use links to mention the right vulnerability

In the tpl. php /--------------------------- function savetagfile Save the label pieces to modify --------------------------/ else if$action=='savetagfile' if! pregmatch"^a-z0-9-1,. lib.php$i", $filename ShowMsg'file name is not legal, not allowed!', '-1'; exit; requireonceDEDEINC.'/...

UBUNTU-CVE-2017-3241

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with...

Lenovo 500 Wireless Keyboard or Mouse Keystroke Injection

Lenovo Security Advisory: LEN-4292 Potential Impact: Potential unwanted data input Severity: Low Summary: An unauthorized attacker may be able to enter keyboard inputs through the Lenovo 500 Wireless keyboard or mouse dongle. Description: A vulnerability was identified where an attacker with...

DEBIAN-CVE-2014-5026

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a 1 Graph Tree Title in a delete or 2 edit action; 3 CDEF Name, 4 Data Input Method Name, or 5 Host Templates Name in a delete action; ...

UBUNTU-CVE-2014-5026

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a 1 Graph Tree Title in a delete or 2 edit action; 3 CDEF Name, 4 Data Input Method Name, or 5 Host Templates Name in a delete action; ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a 1 Graph Tree Title in a delete or 2 edit action; 3 CDEF Name, 4 Data Input Method Name, or 5 Host Templates Name in a delete action; ...

CVE-2014-5026

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a 1 Graph Tree Title in a delete or 2 edit action; 3 CDEF Name, 4 Data Input Method Name, or 5 Host Templates Name in a delete action; ...

RaXnet Cacti 0.6.x/0.8.x Auth_Login.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10960/info RaXnet Cacti is reportedly affected by a remote SQL injection vulnerability. This issue occurs in the authlogin.php script due to a failure of the application to properly sanitize user-supplied username URI...

cURL/libcURL Remote Input Validation

Binary data 6903.prm...

JVN#18501376: OpenPNE vulnerable to cross-site scripting

The management screen in OpenPNE contains an issue in the processing of data input into the "mobile version color scheme configuration" item, which may result in a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the web browser of a user who is logged on as an...

Hitachi Device Manager Software Denial of Service (DoS) Vulnerability

Overview Hitachi Device Manager Software HDvM contains a denial of service abend vulnerability when receiving a large amount of data at once. If HDvM exits abnormally, users will be able to resume using the software by restarting the HDvM service or daemon. Impact A remote attacker could cause a...

Denial of Service (DoS) Vulnerability in JP1/NETM

Overview A Built-in database in JP1/NETM contains a vulnerability that could cause a denial of service DoS condition due to the abnormal ending of the database process when receiving unexpected data. After the process abends, the service can be restarted by rebooting JP1/IM. Impact A remote...