IBOS Enterprise Collaboration Management Software Business Edition Has XSS Vulnerabilities

IBOS Enterprise Collaboration Management Software is an open source office OA system developed by Shenzhen BOS Xiechuang Network Technology Co. IBOS enterprise collaborative management software commercial version of the XSS vulnerability, attackers can use the vulnerability to obtain user cookie...

XSS Vulnerability in Mercury X18G Router

Shenzhen Meike Star Communication Technology Co., Ltd. general business items include: computer wireless LAN products, computer hardware and software, communication equipment, electronic products, network security equipment technology development, etc.. The Mercury X18G router has an XSS...

XSS Vulnerability in SeaCMS

SeaCMS Ocean CMS is a web content management system based on PHP+MYSQL architecture and supports cross-platform operation. SeaCMS has an XSS vulnerability that can be exploited by attackers to obtain user cookie information...

XSS Vulnerability in 53FastService's Online Customer Service System

Zhejiang Fast Service Group Co., Ltd. was established on August 01, 2006 . Legal representative Lou Weibo, the company's business scope includes: general items: technical services, technology development, technology consulting, technology exchanges, technology transfer, technology promotion and s...

KindEditor is vulnerable to XSS

KindEditor is a set of open source online HTML editor . KindEditor has an XSS vulnerability that can be exploited by attackers to obtain user cookie information...

Security Bulletin: Insecure Transmission Vulnerability with IBM InfoSphere Information Server (CVE-2015-7490)

Summary IBM InfoSphere Information Server could allow a malicious user who can login in IIS using their own user id to change the user cookie to another user id to possibly gain access to information that the other user id had access to. Vulnerability Details CVEID: CVE-2015-7490 DESCRIPTION: IBM...

Cross-site Scripting (XSS) - Stored in arachnys/cabot

Description Executed Persistent stored XSS in cabot check settings, as well as the address field. As per CVEs present Stored XSS is a High Severity bug. Proof of Concept 1. setup cabot to reproduce the vulnerability 2. create an account now login to the account 3. Go to checks Create and navigate...

CVE-2019-3414

All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...

Cross site scripting

All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...

CVE-2019-13186

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, and CVE-2018-20520...

PT-2019-17849 · Overit · Geocall

Name of the Vulnerable Software and Affected Versions: OverIT Geocall versions prior to 6.3 build 2:346977 Description: An issue allows an unauthenticated attacker to obtain a cookie of an authenticated user and login to the web application through an unauthenticated servlet. Recommendations: For...

Default configuration

SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a user cookie. If not set, a user is redirected to the login page. An arbitrary value can be provided for this cookie to access the web interface without valid...

CVE-2018-17552

Navigate CMS 2.8 is affected by multiple vulnerabilities described across connected sources. The core CVE-2018-17552 issue is a SQL Injection in login.php that allows bypassing authentication via the navigate-user cookie. Additionally, related sources describe an unauthenticated remote code execu...

CVE-2015-8368

ntopng aka ntop before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/passwordreset.lua...

CVE-2015-8368

ntopng aka ntop before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/passwordreset.lua...

Code injection

ntopng aka ntop before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/passwordreset.lua...

CVE-2015-8368

ntopng aka ntop before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/passwordreset.lua...

CVE-2015-8368

Removed by vendor...

Sql injection

SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier allows remote attackers to execute arbitrary SQL commands via the "user" cookie to plugins/feedback/pages/feedback.php...

HotExBilling Manager Cross-site scripting (XSS) vulnerability

Title: ==== HotExBilling Manager – Cross-site scripting XSS vulnerability Credit: ====== Name: Bhadresh Patel Company/affiliation: HelpAG Website: www.helpag.com CVE: ===== CVE-2015-2781 Date: ==== 12-03-2015 dd/mm/yyyy Vendor: ====== Hotspot Express has been in the billing solution business sinc...