SOS JobScheduler JOC Cockpit Cross-Site Scripting Vulnerability

Cockpit is an interactive server management interface. A cross-site scripting vulnerability exists in the JOC Cockpit component in SOS JobScheduler versions 1.11 and 1.13.2. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploi...

Acunetix v13 - Web Application Security Scanner

Acunetix, the pioneer in automated web application security software, has announced the release of Acunetix Version 13. The new release comes with an improved user interface and introduces innovations such as the SmartScan engine, malware detection functionality, comprehensive network scanning,...

worksing.icmc.usp.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1086994 Security Researcher haxmov Helped patch 708 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting worksing.icmc.usp.br website...

terrassendach1a.de Improper Access Control vulnerability

Security Researcher error404 Helped patch 524 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting terrassendach1a.de website and its users. Following...

Security Bulletin: Aspera Web Application (Faspex, Console, Orchestrator, Shares) are affected by Apache vulnerabilities (CVE-2019-9517, CVE-2019-10097)

Summary Aspera Web Application Faspex, Console, Shares, Orchestrator have affected the following Apache vulnerabilities. Vulnerability Details CVEID: CVE-2019-9517 DESCRIPTION: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of...

Open-School Community Edition Cross-Site Scripting Vulnerability

Open-School is a web-based school management software. The software offers online billing, attendance and online library.Open-School Community Edition is the community edition of Open-School. A cross-site scripting vulnerability exists in Open-School Community Edition version 2.2. The vulnerabili...

Horde CSV import arbitrary PHP code execution

The HordeData module version 2.1.4 and before present in Horde Groupware version 5.2.22 allows authenticated users to inject arbitrary PHP code thus achieving RCE on the server hosting the web application. Module Options msf use exploit/multi/http/horde/csvrce msf undefinedcsvrce show actions...

CVE-2020-5317

Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious...

jollykingdom.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1085593 Security Researcher Dipu1A Helped patch 999 vulnerabilities Received 5 Coordinated Disclosure badges Received 22 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting jollykingdom.com website and...

Red Hat Quay Cross-Site Request Forgery Vulnerability

Red Hat Quay is a distributed container image repository from Red Hat, Inc. that is used to build, distribute and deploy containers. A cross-site request forgery vulnerability exists in Red Hat Quay. The vulnerability stems from a WEB application that does not adequately validate that a request i...

Quarterly Report: Incident Response trends in fall 2019

By David Liebenberg and Kendall McKay. While many Cisco Talos Incident Response CTIR engagements have shown similar patterns over the past two quarters, we’re seeing a dangerous trend emerge this winter. Threat actors are increasingly combining the exfiltration of sensitive data along with data...

SQL injection vulnerability in the M**_in*** parameter of the me***_ed***.php page of S-CMS enterprise website builder system.

S-CMS e-commerce system is developed by php+mysql, the website is easy and fast to install. Search engine is more easy to crawl and index , provide more features to improve user-friendly experience . S-CMS enterprise building system meed.php page Min parameters exist SQL injection vulnerability,...

Arbitrary File Read Vulnerability in AKCMS

AKCMS is a lightweight content management system based on PHP and MySQL. AKCMS has an arbitrary file read vulnerability that can be exploited by an attacker to read arbitrary files...

School ERP System 1.0 Cross Site Request Forgery

Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link: https://sourceforge.net/projects/school-erp-ultimate/files/ Version ERP-Ultimate Tested on...

MassCode Cross-Site Scripting Vulnerability

massCode is the open source code segment manager. A cross-site scripting vulnerability exists in massCode version 1.0.0-alpha.6, which stems from the lack of proper validation of client-side data in a web application and can be exploited by an attacker to execute client-side code...

F5 BIG-IP APM cross-site scripting vulnerability (CNVD-2020-50291)

F5 BIG-IP APM is a suite of access and security solutions from F5 USA. The product provides unified access to business-critical applications and networks. A cross-site scripting vulnerability exists in F5 BIG-IP APM. The vulnerability stems from a lack of proper validation of client data by the W...

School ERP System 1.0 - Cross Site Request Forgery (Add Admin)

Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link: https://sourceforge.net/projects/school-erp-ultimate/files/ Version ERP-Ultimate CVE:...

CVE-2020-8514

An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the web application after invoking the rename folder functionality...

Design/Logic Flaw

An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the web application after invoking the rename folder functionality...

CVE-2020-8514

An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the web application after invoking the rename folder functionality...