4732 matches found
CVE-2018-19170: Improper Neutralization of Input During Web Page Generation
In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the webname parameter...
PT-2018-14839
Name of the Vulnerable Software and Affected Versions JPress version 1.0-rc.5 Description The issue concerns stored XSS that can be triggered via the first three input fields. This is demonstrated by the web name parameter in the "/starter-tomcat-1.0/admin/setting" API endpoint. Recommendations F...
Side-Channel Attack
libgnutls.so is vulnerable to plain text recovery via cache-based side channel. An attacker is able to use a combination of Just in Time Prime+probe and Lucky-13 attacks to recover plain text using crafted packets in a cross-VM setting...
Prayer Information Disclosure Vulnerability
Prayer is an IMAP-based Web mail server. An information disclosure vulnerability exists in Prayer that stems from the header.t lack of no-referrer setting. An attacker can exploit this vulnerability to obtain a username...
Design/Logic Flaw
Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...
CVE-2018-18655
Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...
CVE-2018-18655
Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...
CVE-2018-18655
Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...
Leanote cross-site scripting vulnerability (CNVD-2018-21793)
Leanote is an open source notepad application. A cross-site scripting vulnerability exists in the Blog Basic Setting page in Leanote version 2.6.1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the title field...
Design/Logic Flaw
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page...
CVE-2018-18553
Leanote 2.6.1 is affected by a cross-site scripting (XSS) vulnerability in the Blog Basic Setting title field, exploitable via rendering of the Likes page. The issue stems from mishandling the title field during page rendering, allowing injected scripts/HTML to execute in affected contexts. Pub...
CVE-2018-18553: Improper Neutralization of Input During Web Page Generation
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page...
PT-2018-14512
Name of the Vulnerable Software and Affected Versions Leanote version 2.6.1 Description The issue concerns a mishandling of the title field in the Blog Basic Setting during the rendering of the "likes" page, leading to an XSS issue. Recommendations For Leanote version 2.6.1, update to a version...
CVE-2018-18430
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
CVE-2018-18430
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
Design/Logic Flaw
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
CVE-2018-18430
DESTOON B2B 7.0 contains an XSS vulnerability in admin/setting.inc.php reachable via the first text box to the admin.php URI. The issue is publicly documented across multiple sources (NVD entry CVE-2018-18430; CNVD/CVELIST entries) and is reflected with a CVSS profile indicating a MEDIUM base sev...
DiliCMS Cross-Site Scripting Vulnerability (CNVD-2019-17480)
DiliCMS is a rapid development content management system based on CodeIgniter. DiliCMS has a cross-site scripting vulnerability that can be exploited to inject web scripts and obtain sensitive information via the attachmenturl parameter of admin/index.php/setting/site?tab=siteattachment...