U.S. Dept Of Defense: RXSS Via URI Path - https://██████████/

Hello All I Found RXSS in your OWN Website Steps To Reproduce Go to This Link https://██████/Orders/A%22onerror='alert%60xElkomy%60'testabcd/Login.aspx?ReturnUrl=/Orders Browsers I test them on Firefox and Google Chrome. Fix:- Filter input on arrival Encode data on output Use appropriate response...

CVE-2020-16227

Delta Electronics TPEditor Versions 1.97 and prior. An improper input validation may be exploited by processing a specially crafted project file not validated when the data is entered by a user. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execut...

CVE-2020-16219

Delta Electronics TPEditor Versions 1.97 and prior. An out-of-bounds read may be exploited by processing specially crafted project files. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application...

CVE-2020-16221

Delta Electronics TPEditor Versions 1.97 and prior. A stack-based buffer overflow may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application...

Out-of-bounds

Delta Electronics TPEditor Versions 1.97 and prior. An out-of-bounds read may be exploited by processing specially crafted project files. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application...

CVE-2020-16225

Delta Electronics TPEditor Versions 1.97 and prior. A write-what-where condition may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application...

CVE-2020-16203

Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or...

Sql injection

Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code...

CVE-2020-14497

Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code...

U.S. Dept Of Defense: RXSS - ████

Hello, friends today when I was checking some sites I found this bug on your own website. Detalis XSS Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web...

Path traversal

In Philips Ultrasound ClearVue Versions 3.2 and prior, Ultrasound CX Versions 5.0.2 and prior, Ultrasound EPIQ/Affiniti Versions VM5.0 and prior, Ultrasound Sparq Version 3.0.2 and prior and Ultrasound Xperius all versions, an attacker may use an alternate path or channel that does not require...

CVE-2020-14477 Philips Ultrasound Systems Authentication Bypass Using an Alternate Path or Channel

In Philips Ultrasound ClearVue Versions 3.2 and prior, Ultrasound CX Versions 5.0.2 and prior, Ultrasound EPIQ/Affiniti Versions VM5.0 and prior, Ultrasound Sparq Version 3.0.2 and prior and Ultrasound Xperius all versions, an attacker may use an alternate path or channel that does not require...

Logic Flaw Vulnerability in Online Education System of Beijing IncuTime Technology Co.

Beijing IncuTime Technology Co., Ltd. is a high-tech enterprise specializing in Internet online education platform. The online education system of Beijing IncuTime Technology Co., Ltd. has a logic flaw vulnerability, which can be exploited by an attacker to modify other people's information beyon...

Engel & Völkers Technology GmbH: [go3-intern.engelvoelkers.com] - Reflected XSS in /dGPS3/default.jsp

Summary: The application fails to sanitize user input in https://go3-intern.engelvoelkers.com/dGPS3/default.jsp and reflect the input directly in the HTTP response, allowing the hacker to exploit the vulnerable parameter and have malicious content executed in the victim's browser. Description: A...

Hardcoded credentials

Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient sent and...

CVE-2018-9195

The CVE-2018-9195 entry describes an information-disclosure MITM vulnerability caused by a hardcoded cryptographic key used in the FortiGuard service communication protocol. Affected products include FortiOS 5.6.x (before 5.6.12) and FortiOS 6.x (before 6.0.8), and FortiClient clients (Windows be...

Logic Flaw Vulnerability in Garan Content Management System

Garan Information Technology Shanghai Co., Ltd. is a company that provides software and Internet products and technology development services to customers worldwide. A logic flaw vulnerability exists in the Garan Content Management System CMS, which can be exploited by attackers to obtain or modi...

Override Access Vulnerability in Niushop Mall System

Shanxi NiuKu Information Technology Co., Ltd. is a technical enterprise engaged in the development of mobile Internet-oriented. Niushop mall system has an override access vulnerability, which can be exploited by attackers to modify other users' information...

Privilege Escalation

Microsoft Dynamics On-Premise is vulnerable to Security Feature Bypass. An attacker could gain elevated privileges by capturing and editing the POST request to include a special character in the extension which may leads to modification of information...

SQL Injection Vulnerability in Personal Information Modification on Tpshop Us***.php Page

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the personal information modification section of the Tpshop Us.php page. An attacker can exploit the vulnerability to obtain sensitive information from the...