CVE-2018-16809

Dolibarr up to 7.0.0: the expense reports module (expensereport/card.php) is vulnerable to SQL injection via integer parameters qty and value_unit due to insufficient input validation. Root cause described as an injectable SQL path in that file; impact per CVE notes is high, with a NVD CVSS v3 ba...

CVE-2019-0262

SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0262

SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Scripting XSS vulnerability...

Cross site scripting

SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0262

SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0262

CVE-2019-0262 affects SAP WebIntelligence BILaunchPad (versions 4.10 and 4.20). The vulnerability is a Cross-Site Scripting (XSS) flaw caused by insufficient encoding of user-controlled inputs in generated HTML reports, enabling script execution in a victim’s browser. The available connected docu...

The vulnerability of the “Valid Session” component in the Oracle Reports Developer reporting software allows a perpetrator to gain access to protected information.

The vulnerability of the “Valid Session” component in the Oracle Reports Developer software relates to insufficient access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...

HackerOne: report id is exposed for undisclosed reports in Hacktivity

Summary: This is similar to https://hackerone.com/reports/127620 where the report Id of undisclosed report is visible on graphql query Description: The new hacktivity graphql query includes undisclosed reports, but part of the query result is the report id which is included in private information...

CVE-2019-7286

creationtimestamp| type| source ---|---|--- 2019-02-08 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=361 2019-02-08 16:50:09+00:00| exploited| https://t.me/alexmakus/2622 2019-02-08 16:55:16+00:00| exploited| https://t.me/antichat/3546 2019-08-31 11:34:08+00:00| exploite...

Qualifying Encoders with Akamai

Introduction The encoder qualification program was created to improve the process for vendors that wish to align themselves with Akamai network specific requirements. It is also intended to , mitigate the risk of encoder issues before using in production. A formal process is being introduced to...

Oracle Reports Developer Component Cross-site Scripting (CVE-2019-2413)

A cross-site scripting vulnerability exists in Oracle Reports component. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

CVE-2018-16858

creationtimestamp| type| source ---|---|--- 2019-02-01 14:25:44+00:00| published-proof-of-concept| https://t.me/DC8044Info/66 2019-02-01 21:48:20+00:00| published-proof-of-concept| https://t.me/antichat/3487 2019-02-02 08:49:18+00:00| published-proof-of-concept| https://t.me/news4hack/233...

X (Formerly Twitter): Stored XSS on reports.

Summary: Stored XSS can be submitted on reports, and anyone who will check the report the XSS will trigger. Description: Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application...

Oracle Reports Developer Component 12.2.1.3 - Cross-site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Cross-site Scripting XSS Exploit Author: Mohamed M.Fouad - From SecureMisr Company Vendor Homepage: https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Version: 12.2.1.3 REQUIRED Tested on: Windows 10 CV...

Oracle Fusion Middleware Reports Developer Access Control Error Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is Oracle's Oracle set of business innovation platform for enterprise and cloud environments, which provides middleware, software collections and other features. reports Developer is one of the report development components. An access control erro...

Oracle Reports Developer 12.2.1.3 Cross Site Scripting

Exploit Title: Cross-site Scripting XSS Date: 2019-01-15 Exploit Author: Mohamed M.Fouad - From SecureMisr Company Vendor Homepage: https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Version: 12.2.1.3 REQUIRED Tested on: Windows 10 CVE : CVE-2019-2413 POC:...

Oracle Reports Developer Component 12.2.1.3 - Cross-site Scripting

Oracle Reports Developer Component 12.2.1.3 - Cross-site Scripting Exploit Title: Cross-site Scripting XSS Date: 2019-01-15 Exploit Author: Mohamed M.Fouad - From SecureMisr Company Vendor Homepage: https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Version: 12.2.1.3...

Oracle Reports Developer Component 12.2.1.3 - Cross-site Scripting

Exploit Title: Cross-site Scripting XSS Date: 2019-01-15 Exploit Author: Mohamed M.Fouad - From SecureMisr Company Vendor Homepage: https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Version: 12.2.1.3 REQUIRED Tested on: Windows 10 CVE : CVE-2019-2413 POC:...

CVE-2019-2413

Vulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware subcomponent: Valid Session. The supported version that is affected is 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer...

CVE-2019-2413

Vulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware subcomponent: Valid Session. The supported version that is affected is 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer...