579 matches found
The vulnerability of the Bootstrap plugin for toolkits used to create websites and web applications allows attackers to perform cross-site scripting attacks.
The vulnerability of the Bootstrap plugin for toolkits used in creating websites and web applications is related to the lack of protective measures for website structures. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...
Teclib GLPI Cross-Site Scripting Vulnerability (CNVD-2020-29626)
Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A cross-site scripting vulnerability exists in Teclib GLPI. The vulnerabilit...
Cross-site Scripting (XSS)
typo3/cms-filelist is vulnerable to cross-site scripting XSS attacks. This attack is possible due to lack of sanitization in thefileext field in the formatFileList function of FileLlist.php, allowing an attacker to inject the malicious script, and execute the scripts when a user visit the page an...
Updated git packages fix security vulnerability
Updated git packages fix security vulnerability: Malicious URLs can still cause Git to send a stored credential to the wrong server CvE-2020-111008. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential...
Arbitrary File Read Vulnerability in AppVision's Video Surveillance System
Applusoft specializes in UHD, ultra-long focus, multi-spectral, thermal imaging products, technical services and overall customized solutions. AppVision's video surveillance system has an arbitrary file reading vulnerability, the vulnerability is due to its video surveillance backend does not do...
CVE-2020-7051
Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover...
CVE-2020-7216
An nidhcp4parseresponse memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets without a message type option...
Portfolio Filter Gallery < 1.1.3 - CSRF & Reflected XSS
Lack of CSRF checks on the Filters page could allow attackers to add/edit/update/delete categories and delete all categories, as well as perform reflected XSS attacks. v1.0.8 fixed the reflected XSS, however no CSRF check on delete and deleteallcategory actions v1.1.0 released, no additional fix...
The vulnerability of the Core component of the Oracle VM VirtualBox software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the Core component of the Oracle VM VirtualBox software relates to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...
The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Investor Servicing financial management software allows a perpetrator to gain access to data modification capabilities.
The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Investor Servicing financial management software lies in its lack of access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain read, modify, add, or delete access to data...
BELL-CVE-2019-17451 CVE-2019-17451 does not affect BellSoft software
Bulletin has no description...
BELL-CVE-2019-16163 CVE-2019-16163 does not affect BellSoft software
Bulletin has no description...
The vulnerability of the HECI subsystem of the microprogramming software Intel Converged Security and Manageability Engine and Intel Server Platform Services allows attackers to disclose protected information.
The vulnerability of the HECI microprogramming software’s subsystem, including Intel Converged Security and Manageability Engine and Intel Server Platform Services, is related to the lack of protection for operational data. Exploiting this vulnerability can allow attackers to disclose sensitive...
Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2019-12700)
Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 4.0.0 through 4.10.1, which originates from...
Materialize Cross-Site Scripting Vulnerability
Materialize is a modern responsive front-end framework based on Material Design. A cross-site scripting vulnerability exists in Materialize 1.0.0 and prior versions, which stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploit this vulnerability...
CVE-2019-6441
An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. The password reset functionality of the router doesn't have backend validation for the current password and doesn't require any type of authentication. By...
Moxa IKS and EDS Sensitive Data Lack of Encryption Vulnerability
Moxa IKS and EDS is a series of industrial switches introduced by Moxa. A lack of encryption vulnerability exists in the Moxa IKS and EDS series for sensitive data. The vulnerability stems from the fact that these devices use plaintext to transmit sensitive data. An attacker could exploit the...
The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain control over the application.
The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...
The vulnerability of the search function in the Microsoft .NET Framework allows a perpetrator to access confidential information.
The vulnerability of the search function in the Microsoft .NET Framework lies in the lack of authentication for the HTTP requests that are executed. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential information through a specially crafte...