Bottelet Daybyday Crm 跨站脚本漏洞

Daybyday is a customer relationship management system. A stored cross-site scripting vulnerability exists in Daybyday 2.1.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the Title parameter of the New Lead screen...

Bottelet Daybyday Crm Cross-Site Scripting Vulnerability

Bottelet Daybyday Crm is a builder system for task, time, employee, and vacation management by Bottelet Personal Developers. A cross-site scripting vulnerability exists in Bottelet Daybyday Crm 2.1.0, which allows storing XSS via the company name parameter to a new client screen...

Product update: Virtuozzo PowerPanel Update 1 (7.0.4-30)

The update for Virtuozzo PowerPanel introduces new features as well as stability and usability fixes. Vulnerability id: PP-578 The 'vzapi' command to reset the backup limit to 0 could fail. Vulnerability id: PP-580 A wrong config parameter was documented for instance default backup limit...

Point Of Sale System 1.0 Cross Site Scripting

Exploit Title: Point of Sale System 1.0 - Multiple Stored XSS Exploit Author: Saeed Bala Ahmed r0b0tG4nG Date: 2020-12-18 Vendor Homepage: https://www.sourcecodester.com/php/9620/point-sale-system-pos.html Software Link:...

Product update: Virtuozzo Hybrid Infrastructure 4.0 Update 1

This update provides a new feature, as well as bug fixes and improvements. Vulnerability id: VSTOR-38583 A non-admin user is unable to create volumes from the command line. Vulnerability id: VSTOR-38785 Enabled geo-replication on Backup Gateway with an S3 backend may result in a deadlock...

Interview Management System 1.0 - Stored XSS in Add New Question

Exploit Title: Interview Management System 1.0 - Stored XSS in Add New Question Exploit Author: Saeed Bala Ahmed r0b0tG4nG Date: 2020-12-09 Google Dork: N/A Vendor Homepage: https://www.sourcecodester.com/php/14585/interview-management-system-phpmysqli-full-source-code.html Software Link:...

Happy HaXmas from the Rapid7 Team!

Happy HaXmas, everyone! This has been quite the year, but we’re thrilled that we’re able to keep up our favorite holiday tradition of our annual HaXmas blog series, which features holiday stories, hacking wins from the year, tips and tricks, and general festivity to keep you entertained during th...

Xenstore: new domains inheriting existing node permissions

ISSUE DESCRIPTION Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights are not removed when a domain is destroyed. This means that a new domain created with the same domid will inherit the access rights to Xenstore nodes from the previous domains with the...

CVE-2020-35382

SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user...

CVE-2020-35382

SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user...

Sql injection

SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user...

The story of the year: remote work

The coronavirus pandemic has caused sudden, sweeping change around the world. The necessary social distancing measures are having an impact on all of us. One large part of society that has been affected by these measures more than others is the employed. While direct customer facing businesses li...

Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach

Update Jan 5, 2021: New patching section with two new dashboard widgets showing the number of missing FireEye-related patches in your environment and the number of assets in your environment missing one of those patches. Update Dec 23, 2020: Added a new section on compensating controls. Update De...

CVE-2020-16599

A Null Pointer Dereference vulnerability exists in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.35, in bfdelfgetsymbolversionstring, as demonstrated in nm-new, that can cause a denial of service via a crafted file...

SUSE SLED15 / SLES15 Security Update : MozillaThunderbird / mozilla-nspr (SUSE-SU-2020:3091-1)

This update for MozillaThunderbird and mozilla-nspr fixes the following issues : Mozilla Thunderbird 78.4 - new: MailExtensions: browser.tabs.sendMessage API added - new: MailExtensions: messageDisplayScripts API added - changed: Yahoo and AOL mail users using password authentication will be...

openSUSE Security Update : MozillaThunderbird (openSUSE-2020-2187)

This update for MozillaThunderbird fixes the following issues : TODO - Mozilla Thunderbird 78.5.0 - new: OpenPGP: Added option to disable attaching the public key to a signed message bmo1654950 - new: MailExtensions: 'composeattachments' context added to Menus API bmo1670822 - new: MailExtensions...

Employee Performance Evaluation System 1.0 Cross Site Scripting

Exploit Title: Employee Performance Evaluation System 1.0 - ' Task and Description' Persistent Cross Site Scripting Date: 08/12/2020 Exploit Author: Ritesh Gohil Vendor Homepage: https://www.sourcecodester.com Software Link:...

Moodle 跨站脚本漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that could allow JavaScript to be included in the title of a book chapter without being...

VMware Carbon Black Recognized as “Tech Exit of the Year” at New England Venture Capital Association’s 2020 NEVY Awards

This week, the New England Venture Capital Association named VMware Carbon Black winner of “Tech Exit of the Year” at the eighth annual NEVY Awards. The NEVY Awards recognize the top innovators, investors and companies in the region, and we couldn’t be more thrilled to receive the accolade that...

ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)

Exploit Title: ChurchCRM 4.2.1- Persistent Cross Site ScriptingXSS Date: 2020- 10- 29 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://churchcrm.io/ Software Link: https://github.com/ChurchCRM/CRM Version: 4.2.1 Tested on: Kali Linux 2020.3 Proof Of Concept: ChurchCRM application allo...