CVE-2019-18219: Improper Neutralization of Input During Web Page Generation

Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting XSS vulnerability, as it fails to validate user input. The affected components index.php, upgrade.php allow for JavaScript injection within both GET or POST requests, via a crafted URL or via the UpgradeMode POST parameter...

CVE-2019-14276: Improper Restriction of XML External Entity Reference

WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...

CVE-2019-13392

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

Cross site scripting

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

CSRF vulnerability and missing permission check in crx-content-package-deployer allowed capturing credentials

crx-content-package-deployer did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials...

EUVD-2019-4886

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

PT-2019-13307

Name of the Vulnerable Software and Affected Versions MindPalette NateMail version 3.0.15 Description A reflected Cross-Site Scripting issue allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application reflects the recipient value if ...

CVE-2019-13392: Improper Neutralization of Input During Web Page Generation

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

Popup-Maker < 1.8.12 - Multiple Vulnerabilities

An attacker can partially control the arguments of the doaction, during the initialization of the PUMSite . Because of this, an attacker can call any method which contains an action starting from popmake or pum . This will lead to successful execution of functions which do not require arguments...

PT-2019-15175

Name of the Vulnerable Software and Affected Versions Hydra versions prior to 0.1.9 Description The issue arises from a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. This is attributed to the process header end function, which calls boa...

Intelbras Router WRN150 1.0.18 - Persistent Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Intelbras Router WRN150 1.0.18 - Persistent Cross-Site Scripting Exploit Author: Prof. Joas Antonio Vendor Homepage: https://www.intelbras.com/pt-br/ Software Link: http://en.intelbras.com.br/node/25896 Version: 1.0.18 Test...

CVE-2010-5340: Improper Neutralization of Input During Web Page Generation

IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent in 10.2.0...

VMware Harbor Privilege Escalation (VMSA-2019-0015) (CVE-2019-16097)

The remote VMware Harbor cloud native registry is affected by a remote privilege escalation vulnerability. Instances of VMware Harbor with DB as the authentication backend and which allow users to self-register are vulnerable. An authenticated, non-administrator, remote attacker can exploit this ...

CVE-2018-21024

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

CVE-2018-21024

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

CVE-2018-21024

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

CVE-2018-21024

CVE-2018-21024 affects Centreon Web: a code issue in licenseUpload.php before 2.8.27 allows uploading arbitrary files via POST. Impact is arbitrary file upload on Centreon Web prior to 2.8.27; no exploitation details are provided in the supplied documents. Remediation: upgrade to Centreon Web 2.8...

CVE-2018-21024

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

PT-2019-10450

Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.27 Description The issue allows attackers to upload arbitrary files via a POST request to the licenseUpload.php file. Recommendations For versions prior to 2.8.27, update to version 2.8.27 or later to resolve...

CVE-2018-21024: Unrestricted Upload of File with Dangerous Type

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...