Cross site scripting

In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php comment box, which can be used to get a user's cookie...

Cross site scripting

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186...

CVE-2019-13341

MiniCMS v1.10 contains a stored XSS in mc-admin/conf.php (comment box). The vulnerability arises from insufficient input validation of client-side data, enabling an attacker to steal a user’s cookie. The affected product is MiniCMS 1.10; no patch/version remediation details are provided in the su...

CVE-2019-13340

CVE-2019-13340 affects MiniCMS v1.10 with a stored XSS in mc-admin/post-edit.php (content box). The root cause is unsanitized input being stored in the content field, enabling an attacker to steal a user’s cookie. Impact is aligned with stored XSS, enabling credential/session data exposure; explo...

PT-2019-13276

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186...

PT-2019-13275

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description A stored XSS issue was discovered in the content box of mc-admin/page-edit.php, which can be exploited to obtain a user's cookie. Recommendations For MiniCMS version 1.10, consider disabling the editing...

PT-2019-13277

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description A stored XSS issue was discovered in the comment box of mc-admin/conf.php, which can be exploited to obtain a user's cookie. Recommendations For MiniCMS version 1.10, consider disabling the comment box...

CVE-2019-13341: Improper Neutralization of Input During Web Page Generation

In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php comment box, which can be used to get a user's cookie...

CVE-2019-13339: Improper Neutralization of Input During Web Page Generation

In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php content box, which can be used to get a user's cookie...

CVE-2019-13340: Improper Neutralization of Input During Web Page Generation

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186...

CVE-2019-13186

Affected software: MiniCMS V1.10. The vulnerability is a stored XSS in mc-admin/post-edit.php (via the content box; also similar references mention a tags box). Root cause stated: stored cross-site scripting allows an attacker to obtain a user’s cookie. The CVE entry and Red Hat quis confirm the ...

PT-2019-13175

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, and CVE-2018-20520...

CVE-2019-13186: Improper Neutralization of Input During Web Page Generation

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, and CVE-2018-20520...

ABB 1SAP150000R0379 PM590-MC-KIT AC500 PLC Detection

Binary data 756316.prm...

PT-2019-11280

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk version 9.3 Description: The issue allows session hijacking and privilege escalation. This occurs when an established guest session is automatically converted into an established administrator session. The...

CVE-2019-10008: Session Fixation

Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ logi...

CVE-2019-10273

Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account...

CVE-2019-10273: Improper Authentication

Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account...

PT-2019-11677

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus version 9.3 Description The issue is related to information leakage in the "/mc login" API endpoint, allowing authenticated users to enumerate active users due to a flaw in authentication handling. This enables an...

PT-2019-19742

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for the deletion of articles via a CSRF vulnerability in the "mc-admin/post.php" endpoint, specifically when the "state" parameter is set to "publish" and the "delete" parameter is utilized...