Cacti Cross-Site Scripting Vulnerability (CNVD-2020-04005)

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . A cross-site scripting vulnerability exists in several files in Cac...

Eclipse Memory Analyzer Cross-Site Scripting Vulnerability

Eclipse Memory Analyzer is a memory analysis tool from the Eclipse Foundation. A cross-site scripting vulnerability exists in Eclipse Memory Analyzer 1.9.1 and prior versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can...

CVE-2020-7227

Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.as...

Information disclosure

Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.as...

CVE-2020-7227

Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.as...

CVE-2020-7227

CVE-2020-7227 affects Westermo MRD-315 devices running firmware 1.7.3 and 1.7.4. An information-disclosure vulnerability allows an authenticated remote attacker to retrieve the source code of several web application functions by issuing requests that omit certain mandatory parameters. Affected pa...

Matomo Analytics < 3.13.1 SQL Injection Vulnerability

Matomo Analytics before version 3.13.1 is prone to an SQL injection vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

LOLBITS - C# Reverse Shell Using Background Intelligent Transfer Service (BITS) As Communication Protocol

LOLBITS is a C reverse shell that uses Microsoft's Background Intelligent Transfer Service BITS to communicate with the Command and Control backend. The Command and Control backend is hidden behind an apparently harmless flask web application and it's only accesible when the HTTP requests receive...

Pivotal Software Spring Framework Cross-Site Scripting Vulnerability

Pivotal Software Spring Framework is the U.S. Pivotal Software's set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications . A cross-site scripting vulnerability exists in Pivotal Software Spring Framework versions 5.2.x prior to 5.2.3,...

Rukovoditel Project Management CRM 2.5.2 - 'entities_id' SQL Injection

Exploit Title: Rukovoditel Project Management CRM 2.5.2 - 'entitiesid' SQL Injection Google Dork: N/A Date: 2020-01-15 Blog: https://fatihhcelik.blogspot.com/ Exploit Author: Fatih Çelik Vendor Homepage: https://www.rukovoditel.net/ Software Link: https://sourceforge.net/projects/rukovoditel/...

Transcend WiFiSD Cross-Site Scripting Vulnerability

Transcend WiFiSD is a WiFi-enabled memory card product from Transcend Taiwan, China. A cross-site scripting vulnerability exists in Transcend WiFiSD version 1.8. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the...

Power Quotient International AirCard Cross-Site Scripting Vulnerability

Power Quotient International AirCard is a wireless-enabled memory card from Power Quotient International in Taiwan, China. A cross-site scripting vulnerability exists in Power Quotient International AirCard. The vulnerability stems from a lack of proper validation of client-side data by the web...

Managing Web Application Security

Web application scanners using dynamic application security testing DAST methods are ideal at identifying common vulnerabilities such as cross-site scripting, SQL injection, command execution and more. When used in conjunction with whitebox static application security testing SAST results that...

ASP.NET Core Denial of Service Vulnerability

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A...

ovirt-engine cross-site scripting vulnerability

ovirt-engine is an open source virtualization management engine. A cross-site scripting vulnerability exists in ovirt-engine. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Cayin SMP-PRO4 Cross-Site Scripting Vulnerability

The Cayin SMP-PRO4 is a digital signage player. A cross-site scripting vulnerability exists in Cayin SMP-PRO4. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

millennium.calltrack.co Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1067021 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

OTRS 6.0.x < 6.0.25, 7.0.x < 7.0.14 Message Vulnerability

OTRS is prone to a vulnerability where it is possible to send drafted messages as wrong agent. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

OpenTrade Cross-Site Scripting Vulnerability

OpenTrade is an open source cryptocurrency trading platform. A cross-site scripting vulnerability exists in OpenTrade 0.2.0 and prior versions. The vulnerability stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploit the vulnerability to execute...

Hospital Management System Cross-Site Scripting Vulnerability

Hospity is a cloud-based software for EMR maintenance in hospitals, clinics, labs, and pharmacies. A cross-site scripting vulnerability exists in Hospital Management System version 4.0, which stems from a lack of proper validation of client-side data in the WEB application and can be exploited by...