IBM QRadar SIEM Cross-Site Scripting Vulnerability (CNVD-2019-40708)

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. A cross-site...

JetBrains YouTrack Cross-Site Scripting Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A cross-site scripting vulnerability exists in versions prior to JetBrains YouTrack...

TYPO3 cross-site scripting vulnerability (CNVD-2019-40295)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in the back-end login box in TYPO3. The vulnerability stems from the lack of proper validation of client-side data by the WEB application, which...

JetBrains YouTrack Cross-Site Scripting Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A cross-site scripting vulnerability exists in versions prior to JetBrains YouTrack...

Online Store System Cross-Site Scripting Vulnerability (CNVD-2019-40113)

Online Store System is an e-commerce system. A cross-site scripting vulnerability exists in Online Store System v1.0. The vulnerability stems from a lack of proper validation of client-side data in the web application. An attacker can exploit this vulnerability to execute client-side code...

JetBrains Upsource Cross-Site Scripting Vulnerability

JetBrains Upsource is a set of code review tools from the Czech company JetBrains. A cross-site scripting vulnerability exists in versions prior to JetBrains Upsource 2019.1.1412. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can...

Websieve Cross-Site Scripting Vulnerability

websieve is a web-based email server management program. A cross-site scripting vulnerability exists in websieve version v0.62, which stems from the lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute client-side code...

chromium-browser: URL bar spoof via download redirect

Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

chromium-browser: Extensions can be disabled by trailing slash

Insufficient data validation in extensions in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to disable extensions via a crafted HTML page...

chromium-browser: HTTP authentication spoof

Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

Tyto Software Sahi Pro Cross-Site Scripting Vulnerability

Tyto Software Sahi Pro is a suite of automated testing tools from Tyto Software India. A cross-site scripting vulnerability exists in Tyto Software Sahi Pro version 8.x. The vulnerability stems from a lack of proper validation of client-side data in the web application and can be exploited by an...

The vulnerability of the monitor for distributing electrical loads in Rockwell Automation’s Allen-Bradley PowerMonitor 1000, related to deficiencies in the verification of data entered by users, allows a intruder to gain access to the device.

The vulnerability of the Rockwell Automation Allen-Bradley PowerMonitor 1000 in terms of electrical load distribution is related to deficiencies in data validation by users. Exploiting this vulnerability allows a malicious actor to execute XSS attacks and gain access to the device...

Control Web Panel Cross-Site Scripting Vulnerability

Control Web Panel is a Linux web hosting control panel. A cross-site scripting vulnerability exists in Control Web Panel version 0.9.8.885, which stems from the lack of proper validation of client-side data by the web application and can be exploited by an attacker to execute client-side code...

tonyy dormsystem cross-site scripting vulnerability

tonyy dormsystem is a dormitory information management system. A cross-site scripting vulnerability exists in tonyy dormsystem 1.3 and earlier versions, which stems from a lack of proper validation of client data in the WEB application and can be exploited by an attacker to execute client-side co...

CVE-2019-17139

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Command injection

RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new printer configuration. When this is combined with CVE-2019-14450, an attacker can upload an "external command" configuration as a printer configuration, and achie...

CVE-2019-14451

Repetier-Server 0.8–0.91 is affected by CVE-2019-14451 for improper validation of XML printer configurations, which can enable remote code execution when combined with CVE-2019-14450 (directory traversal) via an uploaded external command configuration. After exploitation, the external command con...

CoreHR Core Portal Cross-Site Scripting Vulnerability

CoreHR Core Portal is a human resource management system. A cross-site scripting vulnerability exists in CoreHR Core Portal versions prior to 27.0.7. The vulnerability stems from the lack of proper validation of client-side data in the WEB application and can be exploited by an attacker to execut...

hexo-admin plugin for Node.js cross-site scripting vulnerability

hexo-admin plugin for Node.js is a backend administration plugin for use in Node.js. A cross-site scripting vulnerability exists in the Post editor feature in hexo-admin plugin for Node.js version 2.3.0 and earlier, which stems from the lack of proper validation of client-side data in a web...