714 matches found
CVE-2018-19443
The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a...
OPManager Cross-Site Scripting Vulnerability
Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. A cross-site scripting vulnerability exists in OPManager, which can be exploited by an attacker to gain access to a user's session or arbitrarily execute JavaScript code on a remote host...
Subsonic cross-site scripting vulnerability (CNVD-2018-20097)
Subsonic is a media file hosting platform developed and maintained by software developer Sindre Mehus. A cross-site scripting vulnerability exists in generalSettings in Subsonic version 6.1.1. A remote attacker can exploit this vulnerability by sending the 'title' and 'subtitle' parameters to the...
Subsonic Cross-Site Scripting Vulnerability
Subsonic is a media file hosting platform developed and maintained by software developer Sindre Mehus. The 'c0-param2', 'c0-param3', and 'c0-param3' parameters in Subsonic version 6.1.1 suffer from a cross-site Scripting vulnerability. A remote attacker can send 'c0-param2', 'c0-param3', and...
CVE-2018-14691
An issue was discovered in Subsonic 6.1.1. The music tags feature is affected by three stored cross-site scripting vulnerabilities in the c0-param2, c0-param3, and c0-param4 parameters to dwr/call/plaincall/tagService.setTags.dwr that could be used to steal session information of a victim...
Cross site scripting
An issue was discovered in Subsonic 6.1.1. The music tags feature is affected by three stored cross-site scripting vulnerabilities in the c0-param2, c0-param3, and c0-param4 parameters to dwr/call/plaincall/tagService.setTags.dwr that could be used to steal session information of a victim...
Cross site scripting
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...
CVE-2018-14689
An issue was discovered in Subsonic 6.1.1. The transcoding settings are affected by five stored cross-site scripting vulnerabilities in the namex, sourceformatsx, targetFormatx, step1x, and step2x parameters where x is an integer to transcodingSettings.view that could be used to steal session...
CVE-2018-14689
An issue was discovered in Subsonic 6.1.1. The transcoding settings are affected by five stored cross-site scripting vulnerabilities in the namex, sourceformatsx, targetFormatx, step1x, and step2x parameters where x is an integer to transcodingSettings.view that could be used to steal session...
CVE-2018-11352
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...
CVE-2018-14690
Subsonic 6.1.1 is affected by two stored cross-site scripting vulnerabilities in the generalSettings.view endpoint (parameters: title and subtitle). The issue can allow an attacker to obtain session information from victims. The CVE entry notes the vulnerability in Subsonic’s generalSettings, but...
CVE-2018-14690
An issue was discovered in Subsonic 6.1.1. The general settings are affected by two stored cross-site scripting vulnerabilities in the title and subtitle parameters to generalSettings.view that could be used to steal session information of a victim...
Philips e-Alert Information Disclosure Vulnerability (CNVD-2019-28283)
Philips e-Alert is an electronic alert solution for MRI systems from Philips in the Netherlands, which is used to monitor and alert on MRI system performance. A security vulnerability exists in Philips e-Alert R2.1 and prior versions, which stems from the program not properly limiting the size of...
PayPal: [Venmo Android] Remote theft of user session
A URL activity in the Venmo application used the built-in android.net.Uri parser, which has a known logic problem with certain characters. If an external URL were passed from a website or other app on the device to the application activity, the app would open the URL without properly validating t...
OpenCart-Overclocked Cross-Site Scripting Vulnerability
OpenCart-Overclocked is an open source shopping cart application. A cross-site scripting vulnerability exists in upload/admin/view/template/extension/openbay.tplL95 in OpenCart-Overclocked 1.11.1 and earlier versions, which stems from the program not filtering user input. A remote attacker could...
FlightAirMap Cross-Site Scripting Vulnerability
FlightAirMap is a free, open source application developed using PHP for displaying flights on a map. A cross-site scripting vulnerability exists in the GET variable on the Registration sub-menu page in FlightAirMap 1.0-beta.21 and earlier versions. A remote attacker can exploit this vulnerability...
CVE-2018-1000642
FlightAirMap version =v1.0-beta.21 contains a Cross Site Scripting XSS vulnerability in GET variable used within registration sub menu page that can result in unauthorised actions and access to data, stealing session information. This vulnerability appears to have been fixed in after commit 22b09...
CVE-2018-1000640
OpenCart-Overclocked version =1.11.1 contains a Cross Site Scripting XSS vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data, stealing session information, denial of service. This attack appear to be...
Cross site scripting
OpenCart-Overclocked version =1.11.1 contains a Cross Site Scripting XSS vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data, stealing session information, denial of service. This attack appear to be...