12563 matches found
CVE-2019-7660
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting XSS vulnerability, as demonstrated by admin/login.php...
Cross site scripting
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting XSS vulnerability, as demonstrated by admin/login.php...
Rpi-Hunter - Automate Discovering And Dropping Payloads On LAN Raspberry Pi's Via SSH
Automate discovering and dropping payloads on LAN Raspberry Pi's via ssh. rpi-hunter is useful when there are multiple Raspberry Pi's on your LAN with default or known credentials, in order to automate sending commands/payloads to them. GUIDE: Installation 1. Install dependencies: sudo pip instal...
Usermin 1.750 - Remote Command Execution Exploit
Exploit for linux platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class MetasploitModule 'Usermin 1.750 - Remote Command Execution', 'Description' ...
WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2019-05294)
WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. WUZHI CMS version 4.1.0 cross-site scripting vulnerability, remote attackers can use the /index.php?m=message&f=message&v=add URL of the 'username' parameter to use the vulnerability to injec...
Cross site scripting
A reflected Cross-Site scripting XSS vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the Login Form...
CVE-2018-18692
A reflected Cross-Site scripting XSS vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the Login Form...
CVE-2018-18692
CVE-2018-18692 is a reflected XSS vulnerability in SEMCO Semcosoft 5.3. The issue allows an attacker to inject arbitrary web scripts or HTML through the username parameter on the Login Form. Affected component: login form handling in Semcosoft 5.3; root cause: insufficient sanitization/escaping o...
CloudBees Jenkins JMS Messaging Plugin Server Request Forgery Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . JMS Messaging Plugin is used in one of the...
PYSEC-2019-255
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page...
PYSEC-2019-255
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page...
CVE-2019-8939
Tautulli 2.1.26 is affected by a reflected XSS in data/interfaces/default/history.html when a crafted Plex username is mishandled during History page construction. The vulnerability could allow JavaScript execution in the context of the Plex server administrator if a user’s username contains inje...
CVE-2019-8939
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page...
DomainMOD 4.11.01 - 'ssl-accounts.php username' Cross-Site Scripting
Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting Date: 2018-11-22 Exploit Author: Mohammed Abdul Raheem Vendor Homepage: domainmod https://domainmod.org/ Software Link: domainmod https://github.com/DomainMod/DomainMod Version: v4.09.03 to v4.11.01 CVE : CVE-2018-20010 A Stored Cross-site...
MGASA-2019-0072 Updated dovecot packages fix security vulnerability
CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field sslcertusernamefield, under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing...
Updated dovecot packages fix security vulnerability
CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field sslcertusernamefield, under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing...
Memory corruption
In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field username, realm, nonce, uri, or response, only the last instance can ever be freed...
UBUNTU-CVE-2019-7732
In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field username, realm, nonce, uri, or response, only the last instance can ever be freed...
