CVE-2020-13239

Dolibarr 11.0.4 DMS/ECM module vulnerability: rendering of user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link enables stored XSS. Root cause is insufficient validation/handling of HTML attachments in Dolibarr’s DMS/ECM component. Report...

CVE-2020-13239

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

CVE-2020-13240

Dolibarr 11.0.4's DMS/ECM module is vulnerable: users with the 'Setup documents directories' permission can rename uploaded files to have insecure file extensions, bypassing the .noexe protection mechanism against XSS. This is a stored cross‑site scripting risk described across multiple sources (...

CVE-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

PT-2020-13389 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 11.0.4 Description: The issue concerns the DMS/ECM module, which renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link, leading to a Cross-Site Scripting XSS...

OpenDocMan 1.3.4 SQL Injection

=========================================================================================== Exploit Title: OpenDocMan 1.3.4 - awherea SQL Injection CVE: N/A Date: 05/03/2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://sourceforge.net/projects/opendocman/files/ Software Link:...

Twitter Draws Data Privacy Concerns with Two New Bugs

Two recently-patched flaws in Twitter’s platform have reignited concerns about user data-privacy issues. On Monday, the social-media giant revealed a hole that accidentally enabled bad actors to pull the country codes of accounts’ phone numbers – and revealed that several IP addresses located in...

ABB NETCADOPS HELP SYSTEM VULNERABILITY

Overview A cross-site scriptinghttp://www.owasp.org/index.php/Cross-siteScriptingXSS vulnerability exists in the system used by the ABB Electrical Distribution Management System DMS product netCADOPS to generate online Help. Affected Products All releases of the ABB netCADOPS product. The ABB...

Ximdex cross-site scripting vulnerability (CNVD-2018-14422)

Ximdex is a content and data management system. The system includes features such as an intelligent search engine, information aggregation, image and text recognition, etc. The DMS component is one of the data management components. A cross-site scripting vulnerability exists in the /edit URI of...

Cross site scripting

The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter...

CVE-2018-12273

The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter...

CVE-2018-12273

The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter...

CVE-2018-12273

The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter...

CVE-2018-12273

The CVE-2018-12273 entry affects Ximdex 4.0, specifically the DMS component. The vulnerability is in the /edit URI and allows cross-site scripting via the Ciudad or Nombre parameter. The issue is documented across multiple feeds (NVD, CNVD, OSV, Red Hat, etc.). The CVSS data indicate a network-ba...

LetoDMS SQL Injection Vulnerability (CNVD-2017-35203)

LetoDMS is a document management system based on PHP+MySQL development. A SQL injection vulnerability exists in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS before version 3.3.8, which can be exploited by remote attackers to execute arbitrary SQL commands...

MEDHOST Document Management Hardcoded Certificate Disclosure Vulnerability

MEDHOST Document Management System is a document management system from the American company MEDHOST. The system manages documents such as user access and audit logs by defining different roles and permissions. A security vulnerability exists in MEDHOST Document Management System due to a...

CVE-2017-11693

MEDHOST Document Management System contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with the database may be able to obtain or modify sensitive patient and financial...

Bihu's uRouter Wireless Router Has Multiple Vulnerabilities

Bihu uRouter Wireless Router is an enterprise-grade intelligent routing product manufactured and marketed by Bihu Technology in China. Multiple vulnerabilities exist in the Bihu uRouter. An unauthenticated attacker can bypass the system authentication mechanism by providing a random SID cookie...

GE Healthcare Centricity DMS Ad Hoc Reporting Trust Management Vulnerability

GE Healthcare Centricity DMS is a General Electric GE cardiology clinical education data management system for the healthcare industry. A security vulnerability exists in the Ad Hoc Reporting feature of GE Healthcare Centricity DMS version 4.2, which originates from an Administrator user using...

CVE-2007-6757

GE Healthcare Centricity DMS 4.2, 4.1, and 4.0 has a password of Muse!Admin for the Museadmin user, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value...