nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting

Exploit Title: nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting Date: 24-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.nopcommerce.com/ Version: 4.30 Tested on: Windows 10/Kali Linux CVE: CVE-2020-29475 Stored Cross-site scriptingXSS: Stored XSS, also...

Schneider Electric EcoStruxure Building Operation WebReports Cross-Site Scripting Vulnerability

EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of user-supplied data. A remote attacker...

JetBrains YouTrack 代码问题漏洞

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in JetBrains YouTrack versions prior to 2020.3.888 that stem...

SQL Injection Vulnerability in RaiseDreams Crowdfunding System pr***.aspx File

RaiseDreams crowdfunding system is an enterprise-level crowdfunding website platform for financial tycoons and enterprises that are about to put into crowdfunding ranks, using asp.net+MsSQL database as the system architecture, and the front-end using html5+css3 modern html language to create a...

Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability (CNVD-2020-57577)

Cisco SD-WAN vManage Software is a management software for SD-WAN Software Defined Wide Area Network solutions from Cisco. A cross-site scripting vulnerability exists in Cisco SD-WAN vManage Software. The vulnerability stems from a lack of proper validation of client data by the WEB application. ...

CVE-2020-16218

CVE-2020-16218 affects Philips PICiX (Patient Information Center iX) versions B.02, C.02, C.03. Root cause: improper neutralization/incorrect neutralization of user-controlled input when generating web pages, enabling potential cross-site scripting that could lead to unauthorized access to patien...

Facebook WhatsApp Desktop Cross-Site Scripting Vulnerability

Facebook WhatsApp is a suite of mobile applications from the American company Facebook that utilize the web to deliver text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, and more. A cross-site scripting...

GetSimple CMS Cross-Site Scripting Vulnerability (CNVD-2020-50147)

GetSimple CMS is a content management system CMS written in PHP. GetSimple CMS v3.3.16 suffers from an XSS vulnerability that stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Pulse Secure Pulse Connect Secure and Pulse Policy Secure Cross-Site Scripting Vulnerabilities

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse and Pulse Policy Secure are both products of Pulse Secure, Inc.Pulse Connect Secure is an SSL VPN solution. Pulse Connect Secure is an SSL VPN solution. Pulse Policy Secure is a network access control solution...

The vulnerability of the Web Access component of the Oracle Primavera P6 Enterprise Project Portfolio Management application allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Web Access component of the Oracle Primavera P6 Enterprise Project Portfolio Management application relates to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protect...

Arbitrary File Deletion Vulnerability in DM Website System

DM building system is developed by php + mysql a set of specialized for small and medium-sized enterprise website construction of open source cms. DM website builder system exists arbitrary file deletion vulnerability. Attackers can exploit the vulnerability to delete arbitrary files...

CloudBees Jenkins Fortify on Demand Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees. The product is mainly used to monitor the continuous software version of the release/testing project and some timed tasks . Fortify on Demand Plugin is used in one of the support for uploading code...

NeDi Consulting NeDi Cross-Site Scripting Vulnerability (CNVD-2020-44587)

NeDi Consulting NeDi is a suite of open source software that supports the discovery and mapping of network devices from the Swiss company NeDi Consulting. A cross-site scripting vulnerability exists in NeDi Consulting NeDi version 1.9C. The vulnerability stems from a lack of proper validation of...

BlackDir-Framework - Web Application Vulnerability Scanner

Web Application Vulnerability Scanner. 1. Spider Directories 2. Find Sub Domain 3. Advanced Dorks Search 4. Scan list of Dorks 5. Scan WebSites Xss,Sql 6. Reverse Ip Lookup 7. Port Scan Installation: git clone https://github.com/RedVirus0/BlackDir-Framework.git cd BlackDir pip3 install -r...

steuerberaten.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1164528 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Online Course Registration SQL Injection Vulnerability

Online Course Registration is a PHP and MySQL based online course registration system from the PHPGurukul team. A SQL injection vulnerability exists in the login page of Online Course Registration version 2.0. An attacker can exploit this vulnerability to bypass authentication. Login pages includ...

Information Disclosure Vulnerability in Intimate Home Care Intimate Cat (imcat)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. Attentive Home Attentive Cat imcat suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Cross-Site Request Forgery Vulnerability in Multiple NETGEAR Products (CNVD-2020-28139)

The NETGEAR WAC505 and others are a wireless access point AP from NETGEAR. A cross-site request forgery vulnerability exists in multiple NETGEAR products, which stems from a WEB application that does not adequately validate that a request is coming from a trusted user, and can be exploited by an...

File Upload Vulnerability in Intimate Home Care Intimate Cat (imcat)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. A file upload vulnerability exists in Intimate Cat imcat, which can be exploited by an attacker to upload a malicious file and then getshell it...

Croogo Cross-Site Scripting Vulnerability (CNVD-2020-33328)

Croogo is a content management system CMS based on the CakePHP framework development . The system provides content type can be customized for Blog, Node, Page, content editing using WYSIWYG editor and other features. A cross-site scripting vulnerability exists in versions prior to Croogo 3.0.7. T...