CVE-2019-20518

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the project/ URI...

CVE-2019-20521

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the api/ URI...

Cross site scripting

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the blog/ URI...

Cross site scripting

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the address/ URI...

Cross site scripting

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the contact/ URI...

Design/Logic Flaw

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the user/ URI, as demonstrated by a crafted e-mail address...

Cross site scripting

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the api/method/ URI...

Design/Logic Flaw

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the project/ URI...

Cross site scripting

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the addresses/ URI...

CVE-2019-20521

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the api/ URI...

CVE-2019-20520

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the api/method/ URI...

CVE-2019-20520

CVE-2019-20520 affects ERPNext 11.1.47 and is a reflected XSS vulnerability that can be triggered via the PATH_INFO to the api/method/ URI. Multiple connected feeds corroborate the same description. CVSS metrics: CVSSv3.1 base score 6.1 (NETWORK, LOW attack complexity, NONE privileges, UI REQUIRE...

CVE-2019-20519

Affected software: ERPNext 11.1.47. Vulnerability: reflected XSS via PATH_INFO to the user/ URI, demonstrated by a crafted e-mail address. Root cause (as stated): improper handling of PATH_INFO leading to script execution on the client side. Impact: client-side code execution risk; severity metri...

CVE-2019-20518

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the project/ URI...

CVE-2019-20517

CVE-2019-20517 affects ERPNext 11.1.47 and is a reflected XSS vulnerability reachable via PATH_INFO to the /contact/ URI. The root cause noted in CNVD-2020-19000 is lack of proper validation of client-side data by the web application, allowing an attacker to execute client-side code. Public refer...

CVE-2019-20516

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the blog/ URI...

CVE-2019-20515

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the addresses/ URI...

CVE-2019-20514

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the address/ URI...

Internet Bug Bounty: Cache Manager ACL Bypass

Summary: ACL Manager can be bypassed giving non authorized users to squid-internal-mgr. Possible to bypass other urlregex, but only focused on manager. with the hostname of the server running squid echo -e "GET https://jeriko.one%252f@:3128/squid-internal-mgr/activerequests HTTP/1.1\r\n\r\n" |nc...

Kyocera ECOSYS M5526CDW Buffer Overflow Vulnerability (CNVD-2020-20975)

The Kyocera ECOSYS M5526CDW is a multifunction printer from Kyocera Japan. A buffer overflow vulnerability exists in the URI path of the Web application in the Kyocera ECOSYS M5526CDW version 2R72000.001.701, which can be exploited by an attacker to cause a denial of service and execute arbitrary...