15171 matches found
Online Store System Cross-Site Scripting Vulnerability (CNVD-2019-40113)
Online Store System is an e-commerce system. A cross-site scripting vulnerability exists in Online Store System v1.0. The vulnerability stems from a lack of proper validation of client-side data in the web application. An attacker can exploit this vulnerability to execute client-side code...
JetBrains Upsource Cross-Site Scripting Vulnerability
JetBrains Upsource is a set of code review tools from the Czech company JetBrains. A cross-site scripting vulnerability exists in versions prior to JetBrains Upsource 2019.1.1412. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can...
ilchCMS 2.1.23 Cross Site Scripting
Information -------------------- Advisory by Netsparker Name: Multiple Cross-site Scripting Vulnerabilities in ilchCMS 2.1.23 Affected Software: ilchCMS Affected Versions: 2.1.23 Vendor Homepage: https://www.ilch.de/ Vulnerability Type: Cross-site Scripting Severity: Medium Status: Fixed CVSS Sco...
TP-Link TL-WDR4300 Cross-Site Request Forgery Vulnerability (CNVD-2019-40473)
The TP-Link TL-WDR4300 is a wireless router from China P&L TP-Link. A cross-site request forgery vulnerability exists in the TP-Link TL-WDR4300 version 3.13.31. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user, and can b...
AVG AntiVirus Cross-Site Scripting Vulnerability (CNVD-2020-10164)
Avast Antivirus is a suite of antivirus software from the Czech company Avast. A cross-site scripting vulnerability exists in Network Notification Popup in Avast AntiVirus Free, Internet Security and Premiere Edition version 19.3.2369 build 19.3.4241.440. The vulnerability stems from a lack of...
File Upload Vulnerability in Blue Route Blog System
Blue Route blog system using PHP + MySQL to build, which is an easy to use, powerful blog system, simple code and double caching mechanism so that the system has a general speed of access. Blue Route blog system has a file upload vulnerability , attackers can exploit the vulnerability to obtain...
Mitsubishi Electric smartRTU and Inea ME-RTU Cross-Site Scripting Vulnerability
Mitsubishi Electric smartRTU is an intelligent Remote Terminal Unit RTU from Mitsubishi Electric, Japan.Inea ME-RTU is an intelligent communication gateway product from Inea, Slovenia. A cross-site scripting vulnerability exists in Mitsubishi Electric smartRTU version 2.02 and earlier and INEA...
Race Condition in Web Applications
Even web application APIs can be subject to race conditions. Check out where it can happen such as the cases of HTTP pipelining, splitting HTTP and others. The post Race Condition in Web Applications appeared first on Wallarm Blog...
SQL injection vulnerability in UQCMS aj***.php page (CNVD-2019-43616)
UQCMS cloud business system is a B2B2C e-commerce software that the program uses PHP+MYSQL and the template uses smarty template. A SQL injection vulnerability exists in the UQCMS aj.php page, which can be exploited by attackers to obtain sensitive information from the database...
Pootle Cross-Site Scripting Vulnerability
Pootle is an online translation management tool. A cross-site scripting vulnerability exists in version 2.0.5-0.2 of pootle, which stems from the lack of proper validation of client-side data in the WEB application and can be exploited by an attacker to execute client-side code...
Moneybird: Bypass password reset rate limit protection at moneybird.com/passwords
Attacker found a way to completely bypass our rate limit protection, allowing for other types of attacks. This involved changing the value of the X-Forwarded-For header. Attacker never got a 429 response from our servers when the value for each request is different. Injecting X-Forwarded-For :...
tonyy dormsystem cross-site scripting vulnerability
tonyy dormsystem is a dormitory information management system. A cross-site scripting vulnerability exists in tonyy dormsystem 1.3 and earlier versions, which stems from a lack of proper validation of client data in the WEB application and can be exploited by an attacker to execute client-side co...
waldronmatt FullCalendar-BS4-PHP-MySQL-JSON 1.21 - (description) Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: waldronmatt FullCalendar-BS4-PHP-MySQL-JSON 1.21 - 'description' Cross-Site Scripting Exploit Author: Cakes Vendor Homepage: waldronmatt/FullCalendar-BS4-PHP-MySQL-JSON Software Link:...
waldronmatt FullCalendar-BS4-PHP-MySQL-JSON 1.21 - 'description' Cross-Site Scripting
Exploit Title: waldronmatt FullCalendar-BS4-PHP-MySQL-JSON 1.21 - 'description' Cross-Site Scripting Date: 2019-10-28 Exploit Author: Cakes Vendor Homepage: waldronmatt/FullCalendar-BS4-PHP-MySQL-JSON Software Link: https://github.com/waldronmatt/FullCalendar-BS4-PHP-MySQL-JSON.git Version: 1.21...
waldronmatt FullCalendar-BS4-PHP-MySQL-JSON 1.21 - description Cross-Site Scripting
waldronmatt FullCalendar-BS4-PHP-MySQL-JSON 1.21 - description Cross-Site Scripting Exploit Title: waldronmatt FullCalendar-BS4-PHP-MySQL-JSON 1.21 - 'description' Cross-Site Scripting Date: 2019-10-28 Exploit Author: Cakes Vendor Homepage: waldronmatt/FullCalendar-BS4-PHP-MySQL-JSON Software Lin...
waldronmatt FullCalendar-BS4-PHP-MySQL-JSON 1.21 Cross Site Scripting
Exploit Title: waldronmatt FullCalendar-BS4-PHP-MySQL-JSON 1.21 - 'description' Cross-Site Scripting Date: 2019-10-28 Exploit Author: Cakes Vendor Homepage: waldronmatt/FullCalendar-BS4-PHP-MySQL-JSON Software Link: https://github.com/waldronmatt/FullCalendar-BS4-PHP-MySQL-JSON.git Version: 1.21...
Code execution vulnerability in dw*** parameter of ad***_we***.php file in seacms backend
seacms ocean film and television management system, ocean cms is based on PHP + MySql technology development of video on demand system. seacms background adwe.php file dw parameter there is a code execution vulnerability, attackers can use the vulnerability to obtain control of the web server...
CVE-2016-2356
Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password...
