Cross site scripting

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies...

CVE-2019-7168

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog...

CVE-2019-7172

A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field to /mods/core/users/admins/myedit.php...

CVE-2019-7170

Affected software: Croogo CMS (versions up to 3.0.5). Vulnerability: Stored-self XSS in the article/title handling, exploitable via the vulnerable Title field submitted to /admin/taxonomy/vocabularies. Impact (as stated): Attacker can execute HTML/JavaScript in a victim’s browser. Root cause (as ...

CVE-2019-7173

Croogo is affected by a stored-self XSS vulnerability in the title field of the Attachment page (/admin/file-manager/attachments/edit/4). Affected versions include Croogo prior to 3.0.7 (v3.0.5 referenced; OSV notes vulnerability before 3.0.7). The root cause is reflected in multiple sources desc...

McAfee Total Protection (MTP) Security Restriction Bypass Vulnerability

McAfee Total Protection is a suite of antivirus software from the American company McAfee McAfee. A security vulnerability exists in the Windows client in McAfee MTP versions prior to 16.0.R18. This vulnerability can be exploited by a local attacker with specially crafted malware to bypass the...

CVE-2019-6990

CVE-2019-6990 is a stored-self XSS in ZoneMinder up to version 1.32.3, triggered via a crafted Zone NAME in the URL index.php?view=zones&action=zoneImage&mid=1. The vulnerability affects web/skins/classic/views/zones.php. Exploitation could allow HTML/JavaScript execution in the vulnerable field....

CVE-2019-6992

CVE-2019-6992 is a stored-self XSS in ZoneMinder up to version 1.32.3, via web/skins/classic/views/controlcaps.php. An attacker can inject HTML/JavaScript by exploiting a long NAME or PROTOCOL in index.php?view=controlcaps, resulting in code execution in the vulnerable field. Exploitation details...

CVE-2019-3593 Exploitation of Privilege/Trust vulnerability

Exploitation of Privilege/Trust vulnerability in Microsoft Windows client in McAfee Total Protection MTP Prior to 16.0.R18 allows local users to bypass product self-protection, tamper with policies and product files, and uninstall McAfee software without permission via specially crafted malware...

CVE-2019-3593

CVE-2019-3593 tracks a privilege/trust vulnerability in the Windows client of McAfee Total Protection (MTP) before version 16.0.R18 . The issue allows local attackers to bypass the product’s self‑protection, tamper with policies and product files, and uninstall McAfee software via specially craft...

CVE-2019-3593

Exploitation of Privilege/Trust vulnerability in Microsoft Windows client in McAfee Total Protection MTP Prior to 16.0.R18 allows local users to bypass product self-protection, tamper with policies and product files, and uninstall McAfee software without permission via specially crafted malware...

U.S. Dept Of Defense: Self XSS combine CSRF at https://████████/index.php

Hi Team, I found that https://█████████/index.php has vulnerability by XSS in arg2 parameter. Anyway there is no csrf token tied with the post request. As a result this csrf flaw can make the self-xss as a global reflected xss. CSRF to XSS PoC history.pushState'', '', '/' You just need to copy an...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : APT vulnerability (USN-3863-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3863-1 advisory. Max Justicz discovered that APT incorrectly handled certain parameters during redirects. If a remote attacker were able to perform a...

WPintel - Chrome Extension Designed For WordPress Vulnerability Scanning And Information Gathering

WordPress Vulnerability Scanner - Scan for vulnerabilities, version, themes, plugins and much more! WPintel allows you to scan self hosted WordPress sites. With WPintel you can detect the following: Version Version vulnerabilities Plugins Themes Users and much more! Although WPintel is designed f...

Unspecified Vulnerability in Oracle PeopleSoft Products (CNVD-2019-29279)

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle that provides human capital management, financial management, supplier relationship management, and other capabilities.PeopleSoft Enterprise HCM eProfile Manager Desktop is PeopleSoft Enterprise HCM...

CVE-2019-2421

Vulnerability in the PeopleSoft Enterprise HCM eProfile Manager Desktop component of Oracle PeopleSoft Products subcomponent: Guided Self Service. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2019-2421

Vulnerability in the PeopleSoft Enterprise HCM eProfile Manager Desktop component of Oracle PeopleSoft Products subcomponent: Guided Self Service. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2019-2421

CVE-2019-2421 affects Oracle PeopleSoft products, specifically the PeopleSoft Enterprise HCM eProfile Manager Desktop component (Guided Self Service) in version 9.2. The vulnerability is in the eProfile Manager Desktop subcomponent, allowing an unauthenticated attacker with network access via HTT...

Cross-site Scripting (XSS)

cloudforms is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as a flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute...

Imperva Increases Self-Service Capability Fourfold with Custom Security Rules

Back in 2014, we introduced Rules previously IncapRules to give our customers advanced control over their application security. Today we’re putting even more of this custom tuning power in the hands of our customers by quadrupling the number of filters available via self-service. Rules Basics Rul...