Open-Xchange (OX) App Suite Content Spoofing Vulnerability (Jun 2018)

Open-Xchange OX App Suite is prone to a content spoofing vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2018-5753: Improper Input Validation

The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to spoof the origin of e-mails via unicode characters in the "personal part" of a 1 From or 2 Sender address...

CVE-2018-12229

Cross-site scripting XSS vulnerability in Public Knowledge Project PKP Open Journal System OJS 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter aka the By Author field...

CVE-2018-12229

The CVE-2018-12229 issue affects PKP Open Journal System (OJS) versions 3.0.0 through 3.1.1-1. The root cause is a cross-site scripting flaw in the templates/frontend/pages/search.tpl, specifically via the By Author field, allowing remote attackers to inject arbitrary web script or HTML. Some sou...

PT-2018-11060

Name of the Vulnerable Software and Affected Versions Public Knowledge Project PKP Open Journal System OJS versions 3.0.0 through 3.1.1-1 Description The issue allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter, also known as the B...

Remote code execution

js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network o...

CVE-2016-10638

js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network o...

CVE-2016-10638

js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network o...

CVE-2016-10638

The CVE-2016-10638 issue affects the JavaScript frontend js-given, which downloads binary resources over HTTP. The root cause is insecure (unencrypted) HTTP delivery, enabling a MitM attacker to intercept the response and substitute the requested binary with a malicious one, potentially leading t...

Cscms v3.53.5 SQL Injection Vulnerability in Frontend

Cscms is a diversified content management system developed using PHP5+MYSQL as the technical basis. Cscms v3.53.5 has a SQL injection vulnerability in the frontend. An attacker can exploit the vulnerability to obtain sensitive information from the database...

Web Application Penetration Testing Tool: Tracy

Tracy is a pentesting tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner. tracy should be used during the mapping-the-application phase of the pentest to identify sources of input and their corresponding outputs. tracy...

Cloud EC e-commerce system has multiple SQL injection vulnerabilities in the frontend

Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system has multiple SQL injection vulnerabilities in the frontend. Attackers can use the...

Zulip Server Cross-Site Scripting Vulnerability (CNVD-2018-08600)

Zulip Server is a set of open source group chat application written in Python based on the Django framework . frontend markdown processor is one of the front-end markdown markup language processor . A cross-site scripting vulnerability exists in the frontend markdown processor in Zulip Server...

Cross site scripting

In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...

CVE-2018-9986

In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...

CVE-2018-9986

In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...

CVE-2018-9986: Improper Neutralization of Input During Web Page Generation

In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...

ShopsN v2.2.6 SQL Injection Vulnerability on Frontend Page

ShopsN Mall system is a product of Shanghai Yiso Network Technology Co., Ltd, an enterprise-class commercial standard full-featured allow free commercial use of the open source online store full network system. A SQL injection vulnerability exists in the front page of ShopsN v2.2.6 official...

The Firmware Analysis and Comparison Tool: FACT

The Firmware Analysis and Comparison Tool formerly known as Fraunhofer’s Firmware Analysis Framework FAF is intended to automate most of the firmware analysis process. It unpacks arbitrary firmware files and processes several analysis. Additionally, it can compare several images or single files...

SQL Injection Vulnerability in Frontend of gxlcmsqy System

GxlcmsQY system is a simple program tailored for business users. A SQL injection vulnerability exists in the frontend of the gxlcmsqy system. An attacker can exploit this vulnerability to obtain sensitive database information...