ManageEngine AssetExplorer 6.2.0 Cross Site Scripting Vulnerability

In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter. Exploit Title: ManageEngine AssetExplorer 6.2.0 - Stored XSS Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardwa...

Subsonic cross-site scripting vulnerability (CNVD-2018-19874)

Subsonic is a media file hosting platform. The 'namex', 'streamUrlx', and 'homepageUrlx' in the Subsonic version 6.1.1 A cross-site scripting vulnerability exists in the 'namex', 'streamUrlx', and 'homepageUrlx' parameters, which can be exploited by a remote attacker by sending 'namex',...

CVE-2018-14689

An issue was discovered in Subsonic 6.1.1. The transcoding settings are affected by five stored cross-site scripting vulnerabilities in the namex, sourceformatsx, targetFormatx, step1x, and step2x parameters where x is an integer to transcodingSettings.view that could be used to steal session...

CVE-2018-16953

The AjaxView::DisplayResponse function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting XSS. User input from the name parameter is unsafely reflected in the server response. NOTE: this CVE is assigned by MITRE and isn't...

Cross site scripting

The AjaxView::DisplayResponse function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting XSS. User input from the name parameter is unsafely reflected in the server response. NOTE: this CVE is assigned by MITRE and isn't...

Oracle WebCenter Interaction Cross-Site Scripting Vulnerability (CNVD-2018-19487)

Oracle WebCenter Interaction is Oracle's suite for creating enterprise portals, collaborative communities, portfolio applications, and social applications.Oracle WebCenter Interaction Portal is one of the management interfaces. A cross-site scripting vulnerability exists in the...

CVE-2018-16432

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

SQL Injection Vulnerability in OpenCart

OpenCart is an open source e-commerce building system developed using PHP. The system is easy to install, powerful, simple to operate, and supports multi-language, multi-currency and multi-store. OpenCart Chinese free version v3.0 there are SQL injection vulnerabilities , the vulnerability stems...

Arbitrary File Deletion Vulnerability in Apple CMS v10

Apple CMS is a well-established and powerful rapid site builder running on PHP+MYSQL environment. Apple CMS v10 background there are arbitrary file deletion vulnerability, the vulnerability stems from the $name, $force parameters are not filtered, an attacker can use the vulnerability to delete...

Cross-Site Scripting (XSS)

fuelux is vulnerable to cross-site scripting XSS vulnerability. It is possible because it allows the name parameter of DE in the email admin screen to directly render as HTML...

QCMS cross-site scripting vulnerability (CNVD-2019-10283)

QCMS is an open source content management system CMS for creating responsive websites. A cross-site scripting vulnerability exists in upload/System/Controller/guest.php in QCMS 3.0.1, which can be exploited by an attacker via the name parameter...

CVE-2018-14977

An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different vulnerability than CVE-2018-8070...

SecurityCenter Cross-Site Scripting Vulnerability

Tenable SecurityCenter is a Nessus-inclusive vulnerability management platform from US-based Tenable Network Security. The platform simplifies vulnerability scanning, management and reporting and provides a console to manage policies, alerts, reports and plug-ins for Nessus. A cross-site scriptin...

PT-2018-2662 · Linksys · Linksys E2500 +1

Name of the Vulnerable Software and Affected Versions: Linksys E1200 versions 2.0.09 Linksys E2500 versions 3.0.04 Description: The issue exists due to improper filtering of data passed to and retrieved from NVRAM, allowing for OS command injection. This can be exploited by a remote attacker to...

Synology CardDAV Server Cross-Site Scripting Vulnerability

Synology CardDAV Server is a Synology application for synchronizing address books, and Address Book Editor is one of the address book editors. A cross-site scripting vulnerability exists in Address Book Editor in Synology CardDAV Server versions prior to 6.0.8-0086. The vulnerability can be...

CVE-2018-12999

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...

CVE-2018-1000536

Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine, within the rights of th...

CVE-2018-1000536

Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine, within the rights of th...

Cross site scripting

Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine, within the rights of th...

CVE-2018-1000536

Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine, within the rights of th...