344 matches found
ProjectSend cross-site scripting vulnerability (CNVD-2019-36883)
ProjectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A cross-site scripting vulnerability exists in the 'Name' field of the My Account page in versions prior to ProjectSend r1053. The vulnerability stems from the WEB application's lack of proper...
CVE-2018-7201
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
Input validation
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
CVE-2018-7201
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
CVE-2018-7201
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
CVE-2018-7201
CVE-2018-7201 corresponds to a CSV Injection vulnerability in ProjectSend prior to version r1053. The issue arises when exporting/loading data for use in Microsoft Excel, enabling injection via CSV fields. Affected product: ProjectSend (before r1053). Root cause details are described only as a CS...
CVE-2018-7202
An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page...
CVE-2018-7202
An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page...
CVE-2018-7202
CVE-2018-7202 affects ProjectSend prior to r1053, where an XSS flaw exists in the Name field on the My Account page. Root cause: insufficient input validation/escaping in that field, enabling injection of client-side scripts. Impact is cross-site scripting affecting users handling their My Accoun...
CVE-2018-7202
An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page...
ProjectSend CVS Injection Vulnerability
rojectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A CVS injection vulnerability exists in versions prior to ProjectSend r1053 that affects victims who import data into Microsoft Excel...
CVE-2019-11533
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11492
ProjectSend before r1070 writes user passwords to the server logs...
Cross site scripting
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11533
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11492
ProjectSend before r1070 writes user passwords to the server logs...
Code injection
ProjectSend before r1070 writes user passwords to the server logs...
CVE-2019-11533
Cross-site scripting XSS vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-11533
CVE-2019-11533 affects ProjectSend prior to r1070, with a cross-site scripting (XSS) vulnerability that could allow remote attackers to inject arbitrary script/HTML. The issue stems from insufficient input sanitization in the affected component, enabling client-side script execution in the contex...