IcedID Circulates Via Web Forms, Google URLs

Website contact forms and Google URLs are being used to spread the IcedID trojan, according to researchers at Microsoft. Attackers are using “contact us” forms on websites to send emails targeting organizations with trumped-up legal threats, researchers said. The messages consistently mention a...

Android Security Bulletin—April 2021Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2021-04-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

cve_manager_VS - A Collection Of Python Apps And Shell Scripts To Email An Xlsx Spreadsheet Of New Vulnerabilities In The NIST CVE Database And Their Associated Products On A Daily Schedule

A collection of python apps and shell scripts to email an xlsx spreadsheet of new vulnerabilities in the NIST CVE database and their associated products on a daily schedule. The spreadsheet can then be manually interpreted for risk to your specific organization. Based off of an opensource product...

PT-2021-8867

Name of the Vulnerable Software and Affected Versions OpenShift Container Platform 4 affected versions not specified Description A flaw was discovered where users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host networ...

The vulnerability of the FortiSIEM security management portal, related to improper input neutralization, allows attackers to perform cross-site scripting attacks.

The vulnerability of the FortiSIEM security management portal is related to improper handling of input values in the parameters describing the device’s service schedule. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2021-26716

Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter...

CVE-2020-29142

A SQL injection vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedulefacility parameter when restrictuserfacility=on is in global settings...

OpenEMR SQL注入漏洞

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A SQL injection vulnerability exists in interface/usergroup/usergroupadmin.php in OpenEMR versions prior to 5.0.2.5. A remote authenticated attacker can exploit this vulnerability to execute...

PT-2021-11646

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2.5 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary SQL commands via the schedule facility parameter when restrict user facility=on is in global settings. This occur...

Solarwinds Web Help Desk Cross-Site Scripting Vulnerability (CNVD-2021-05123)

Solarwinds Web Help Desk is a suite of help desk and asset management software from Solarwinds USA. The software supports centralized knowledge base, IT asset management, project and task management, and more. SolarWinds Web Help Desk 12.7.0 suffers from a cross-site scripting vulnerability that...

CVE-2019-16961

SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name...

CVE-2019-16961

SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name...

Design/Logic Flaw

SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name...

CVE-2019-16961

SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name...

CVE-2019-16961

CVE-2019-16961 affects SolarWinds Web Help Desk 12.7.0 and is a cross-site scripting (XSS) vulnerability exploitable via a Schedule Name. The connected Red Hat/CNVD/NVD entries corroborate the same issue. The NVD metrics list a CVSS v3.1 base score of 5.4 (MEDIUM) with network attack vector, low ...

PT-2021-8995

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for XSS via a Schedule Name. Recommendations For SolarWinds Web Help Desk version 12.7.0, update to a version that fixes this issue to prevent XSS attacks. At the moment, the...

Solarwinds Web Help Desk 跨站脚本漏洞

Solarwinds Web Help Desk is a suite of help desk and asset management software from Solarwinds USA. The software supports centralized knowledge base, IT asset management, project and task management, and more. SolarWinds Web Help Desk 12.7.0 suffers from a cross-site scripting vulnerability that...

CVE-2019-16961: Improper Neutralization of Input During Web Page Generation

SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name...

CVE-2020-29475

nopCommerce Store 4.30 is affected by cross-site scripting XSS in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XSS triggers and attacker can able to steal the...

Cross site scripting

nopCommerce Store 4.30 is affected by cross-site scripting XSS in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XSS triggers and attacker can able to steal the...