SAP BusinessObjects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2019-34745)

SAP BusinessObjects Business Intelligence Platform is a suite of bookstore intelligence software and enterprise performance solutions from Germany's SAP. The product features report generation, analytics and data visualization. A cross-site scripting vulnerability exists in SAP BusinessObjects...

Joomla! < 3.9.7 Multiple Vulnerabilities

Joomla! is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Adobe ColdFusion Code Injection Vulnerability (APSB19-27)

Adobe ColdFusion is prone to a code injection vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:coldfusion"; i...

CVE-2019-3413

The CVE-2019-3413 entry concerns an XSS vulnerability in ZTE NetNumen DAP. All versions up to V20.18.40.R7.B1 are affected due to insufficient validation of client data in Web applications, which can lead to user account hijacking. The connected documents confirm the issue and reiterate the same ...

CVE-2019-3410

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fact that WEB applications do not adequately verify whether requests come from trusted users. An attacker can exploit this vulnerability to sen...

Command Execution Vulnerability in DM Enterprise Website System

DM enterprise building system is developed by php + mysql a set of specialized in small and medium-sized enterprise website construction of open source cms. DM enterprise website building system has a command execution vulnerability , attackers can use the vulnerability to obtain server privilege...

CVE-2019-11027

Ruby OpenID aka ruby-openid through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developer...

Cloudera Manager Cross-Site Scripting Vulnerability

Cloudera Manager is a suite of Hadoop data management software from Cloudera. The software supports creating clusters, authentication, data backup and recovery, and more. A cross-site scripting vulnerability exists in Cloudera Manager. The vulnerability stems from the lack of proper authenticatio...

Authentication flaw

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. Furthermore, the user account that controls the web...

CVE-2019-12775

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. Furthermore, the user account that controls the web...

CVE-2019-12775

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. Furthermore, the user account that controls the web...

Symfony Authentication Bypass Vulnerability (Jul 2017)

Symfony is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sensiolabs:symfony"; ...

CVE-2019-7553

PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field...

ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-16939)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...

Geutebrück G-Cam and G-Code Cross-Site Scripting Vulnerabilities

G-Cam is a series of webcams from Geutebrück.G-Code is an analog video encoder from Geutebrück. A cross-site scripting vulnerability exists in Geutebrück G-Cam and G-Code. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker can exploit the...

Open-Xchange (OX) App Suite < 7.8.3-rev13 Multiple Vulnerabilities

Open-Xchange OX App Suite is prone to multiple vulnerabilities. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...

Security Bulletin: IBM Security Information Queue web application is vulnerable to clickjacking attack

Summary The IBM Security Information Queue ISIQ web application is vulnerable to a clickjacking attack in which an untrusted page could get embedded into another frame or object. As of v1.0.3, the ISIQ web server disallows browsers from embedding content. Vulnerability Details CVEID: CVE-2019-421...

SAET Impianti Speciali TEBE Small WebApp Path Traversal Vulnerability

SAET Impianti Speciali TEBE Small is a physical access control system from the Italian company SAET. webApp is one of the web-based management programs. A path traversal vulnerability exists in WebApp version v04.68 in SAET Impianti Speciali TEBE Small 05.01 build 1137, which can be exploited by ...

CVE-2019-9839

VFront 0.99.5 has Reflected XSS via the admin/menuregistri.php descrizioneg parameter or the admin/syncregtab.php azzera parameter...

SQL Injection Vulnerability in B2C_UQ Cloud Business System

UQ Cloud Business System B2C version is a compact e-commerce system, the platform is developed by PHP7.0+Mysql. B2CUQ Cloud Business System suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...