Design/Logic Flaw

OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages...

CVE-2019-15081

OpenCart 3.x is affected. The vulnerability is a stored XSS in the admin panel’s Source/HTML editing for Categories, Product, and Information pages, exploitable when an attacker has login access. Root cause: unsanitized input in the admin editing feature allows arbitrary JavaScript execution on t...

PT-2019-13728 · Evolution Cms · Evolution Cms

Name of the Vulnerable Software and Affected Versions: Evolution CMS versions 2.0.x Description: The issue allows for XSS via a description and new category location in a template. The vendor states that the behavior is consistent with the access policy in the administration panel. Recommendation...

CVE-2019-15081: Improper Neutralization of Input During Web Page Generation

OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages...

CVE-2019-14805

studio/buildermenu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing...

CVE-2019-14804

studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing...

CVE-2019-14805

studio/buildermenu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing...

CVE-2019-14804

studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing...

CVE-2019-14804

studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing...

CVE-2019-14805: Improper Neutralization of Input During Web Page Generation

studio/buildermenu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing...

Important: Red Hat Security Advisory: augeas security update

An update for augeas is now available for Red Hat Enterprise Linux 7.3 Advanced Update Support, Red Hat Enterprise Linux 7.3 Telco Extended Update Support, and Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impac...

Moderate: Red Hat Security Advisory: zsh security and bug fix update

An update for zsh is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

CVE-2019-7934

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7865

A cross-site request forgery CSRF vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration...

CVE-2019-7865

A cross-site request forgery CSRF vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration...

CVE-2019-7865: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration...

ALPINE-CVE-2019-13638

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156...

CVE-2019-1010124

WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting XSS. The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in...

Mail.ru: [auto.mail.ru] IDOR на редактирование поста любого юзера.

IDOR allowed to edit arbitrary posts in auto.mail.ru auto.mail.ru belongs to Extended scope IDOR на редактирование произвольного поста на сайте auto.mail.ru...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack exists because it does not validate the file name provided by the user, allowing an attacker to inject a malicious script through it to get executed during editing of attachments/edit/$fileid$ attachment...