15167 matches found
Navigate CMS 2.8.7 SQL Injection
Exploit Title: Navigate CMS 2.8.7 - ''sidx' SQL Injection Authenticated Date: 2020-06-04 Exploit Author: Gus Ralph Vendor Homepage: https://www.navigatecms.com/en/home Software Link: https://sourceforge.net/projects/navigatecms/files/releases/navigate-2.8.7r1401.zip/download Version: 2.8.7 Tested...
CloudBees Jenkins ECharts API Plugin Cross-Site Scripting Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . ECharts API Plugin is used in one of the chart...
Codeorigin Sysax Multi Server Cross-Site Scripting Vulnerability
Codeorigin Sysax Multi Server is an FTP File Transfer Protocol server and Shell server for Windows from Codeorigin USA. A cross-site scripting vulnerability exists in Codeorigin Sysax Multi Server version 6.90. The vulnerability stems from a lack of proper validation of client data by the WEB...
Grafana Cross-Site Scripting Vulnerability (CNVD-2020-38873)
Grafana is a set of open source monitoring tools from Grafana Labs that provide a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. A cross-site scripting vulnerability exists in Grafana version 5.3.1. The vulnerabilit...
Vxscan
This is a Python script for a comprehensive scanning tool called Vxscan. The tool is designed to perform various types of scans, including sensitive file detection, WAF/CDN identification, port scanning, fingerprint/service identification, operating system identification, weak password detection,...
CVE-2020-12017
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...
CVE-2020-12017
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...
Authentication flaw
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...
CVE-2020-12017
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...
CVE-2020-12017
CVE-2020-12017 affects GE Grid Solutions Reason RT Clocks RT430, RT431, and RT434 (firmware
Bitrix24 Web Application Firewall Cross-Site Scripting Vulnerability
Bitrix24 is a suite of enterprise social platforms from Bitrix, USA. The platform includes features such as online communication, calendar management and CRM Customer Relationship Management.Web Application Firewall is one of the Web Application Firewalls. A cross-site scripting vulnerability...
Lexiglot Cross-Site Request Forgery Vulnerability
Lexiglot is a translation platform written in PHP by the French software developer Damien Sorel. A cross-site request forgery vulnerability exists in Lexiglot 2014-11-20 and earlier versions, which stems from the program failing to properly validate user input. A remote attacker could exploit thi...
CVE-2020-13758
modules/security/classes/general.postfilter.php/postfilter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload...
CVE-2020-13758
modules/security/classes/general.postfilter.php/postfilter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload...
Cross site scripting
modules/security/classes/general.postfilter.php/postfilter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload...
CVE-2020-13758
The CVE-2020-13758 issue affects Bitrix24 Web Application Firewall prior to or up to 20.0.950, specifically the modules/security/classes/general.post_filter.php/post_filter.php. The vulnerability is an XSS flaw introduced by the ability to place a NULL byte (%00) before the payload, enabling an a...
Information Disclosure
com.liferay.login.web is vulnerable to information disclosure. The attack exists because Sign In widget leaks user's email address and/or password allowing a malicious user to intercept the sensitive information if HTTPS is not in place...
agritechwest.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1178889 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
WordPress Calculated Fields Form Plugin Cross Site Scripting (CVE-2020-7228)
A stored cross-site scripting vulnerability exists in Calculated Fields Form plugin of WordPress. The vulnerability is due to insufficient sanitization of user input to "field name" and "form name" of a form in the web application of the plugin...
WordPress Multi-Scheduler 1.0.0 - Cross Site Request Forgery
WordPress Multi-Scheduler plugin version 1.0.0 suffers from a cross site request forgery vulnerability. Exploit Title: WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery Delete User Google Dork: N/A Date: 2020-05-21 Exploit Author: UnD3sc0n0c1d0 Vendor Homepage:...