603 matches found
sangga.jipmani.com Cross Site Scripting vulnerability OBB-1217358
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
GetInstalledPackages function in the Data Compromise
The vulnerability of the GetInstalledPackages function in the Application Lifestyle Management installation manager is related to the lack of mechanisms for privilege control and access management. Exploiting this vulnerability could allow an attacker to gain unauthorized access to confidential...
CVE-2020-13814
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It has a use-after-free via a document that lacks a dictionary...
Bootstrap Plugin XSS
The vulnerability of the Bootstrap plugin for toolkits used in creating websites and web applications is related to the lack of protective measures for website structures. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...
Teclib GLPI Cross-Site Scripting Vulnerability (CNVD-2020-29626)
Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A cross-site scripting vulnerability exists in Teclib GLPI. The vulnerabilit...
Cross-site Scripting (XSS)
typo3/cms-filelist is vulnerable to cross-site scripting XSS attacks. This attack is possible due to lack of sanitization in thefileext field in the formatFileList function of FileLlist.php, allowing an attacker to inject the malicious script, and execute the scripts when a user visit the page an...
Updated git packages fix security vulnerability
Updated git packages fix security vulnerability: Malicious URLs can still cause Git to send a stored credential to the wrong server CvE-2020-111008. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential...
Arbitrary File Read Vulnerability in AppVision's Video Surveillance System
Applusoft specializes in UHD, ultra-long focus, multi-spectral, thermal imaging products, technical services and overall customized solutions. AppVision's video surveillance system has an arbitrary file reading vulnerability, the vulnerability is due to its video surveillance backend does not do...
CVE-2020-7051
Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover...
CVE-2020-7216
An nidhcp4parseresponse memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets without a message type option...
Portfolio Filter Gallery < 1.1.3 - CSRF & Reflected XSS
Lack of CSRF checks on the Filters page could allow attackers to add/edit/update/delete categories and delete all categories, as well as perform reflected XSS attacks. v1.0.8 fixed the reflected XSS, however no CSRF check on delete and deleteallcategory actions v1.1.0 released, no additional fix...
Oracle VM VirtualBox Core Component Data Compromise
The vulnerability of the Core component of the Oracle VM VirtualBox software relates to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...
Oracle FLEXCUBE Investor Servicing Data Modification
The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Investor Servicing financial management software lies in its lack of access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain read, modify, add, or delete access to data...
BELL-CVE-2019-17451 CVE-2019-17451 does not affect BellSoft software
Bulletin has no description...
BELL-CVE-2019-16163 CVE-2019-16163 does not affect BellSoft software
Bulletin has no description...
CVE-2019-10992: Out-of-bounds Read
Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple out-of-bounds read vulnerabilities may cause information disclosure due to lacking user input validation for processing project files...
HECI Subsystem Disclosure
The vulnerability of the HECI microprogramming software’s subsystem, including Intel Converged Security and Manageability Engine and Intel Server Platform Services, is related to the lack of protection for operational data. Exploiting this vulnerability can allow attackers to disclose sensitive...
Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2019-12700)
Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 4.0.0 through 4.10.1, which originates from...
Materialize Cross-Site Scripting Vulnerability
Materialize is a modern responsive front-end framework based on Material Design. A cross-site scripting vulnerability exists in Materialize 1.0.0 and prior versions, which stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploit this vulnerability...
CVE-2019-6441
An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. The password reset functionality of the router doesn't have backend validation for the current password and doesn't require any type of authentication. By...