Zimbra Collaboration Cross-Site Scripting Vulnerability (CNVD-2020-05085)

Zimbra Collaboration is a suite of email and collaboration solutions from Zimbra USA. The solution offers email, contacts, calendaring, file sharing, social networking, and more. A cross-site scripting vulnerability exists in Zimbra Collaboration. The vulnerability stems from the WEB application...

WSO2 API Manager Cross-Site Scripting Vulnerability (CNVD-2020-05075)

WSO2 API Manager is an open source api management platform , provides a series of api creation , release , lifecycle management , version control , monetization, governance and security features , used to support organizations to achieve soa. A cross-site scripting vulnerability exists in WSO2 AP...

Fixed in Apache Tomcat 9.0.31

Important: AJP Request Injection and potential Remote Code Execution CVE-2020-1938 When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. I...

Dell EMC ECS Cross-Site Scripting Vulnerability

DELL EMC ELASTIC CLOUD STORAGE ECS software-defined object storage, designed for legacy and next-generation workloads, offers excellent scalability, flexibility and resiliency. Dell EMC ECS cross-site scripting vulnerability. The vulnerability stems from a lack of proper validation of client data...

Zimbra Collaboration Cross-Site Scripting Vulnerability (CNVD-2020-05089)

Zimbra Collaboration is a suite of email and collaboration solutions from Zimbra USA. The solution offers email, contacts, calendaring, file sharing, social networking, and more. A cross-site scripting vulnerability exists in Zimbra Collaboration. The vulnerability stems from the WEB application...

WSO2 API Manager Cross-Site Scripting Vulnerability (CNVD-2020-05077)

WSO2 API Manager is an open source api management platform , provides a series of api creation , release , lifecycle management , version control , monetization, governance and security features , used to support organizations to achieve soa. A cross-site scripting vulnerability exists in WSO2 AP...

WSO2 API Manager Cross-Site Scripting Vulnerability (CNVD-2020-05093)

WSO2 API Manager is an open source api management platform , provides a series of api creation , release , lifecycle management , version control , monetization, governance and security features , used to support organizations to achieve soa. A cross-site scripting vulnerability exists in WSO2 AP...

Adive Framework Cross-Site Request Forgery Vulnerability

Adive Framework is a PHP-based MySQL database management framework . A cross-site request forgery vulnerability exists in Adive Framework. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could exploit this...

Eyes Of Network (EON) <= 2.4.2 Multiple API Vulnerabilities

Eyes Of Network EON is prone to multiple vulnerabilities over the API. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross site scripting

Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application...

CVE-2020-8822

Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application...

CVE-2020-8822

The CVE-2020-8822 entry concerns Digi TransPort devices (WR21 5.2.2.3; WR44 5.1.6.4; WR44v2 5.1.6.9) with a reported stored XSS vulnerability in the web application. Connected documents consistently reference the same affected models and versions, and describe the issue as stored XSS but do not p...

SOS JobScheduler JOC Cockpit Cross-Site Scripting Vulnerability

Cockpit is an interactive server management interface. A cross-site scripting vulnerability exists in the JOC Cockpit component in SOS JobScheduler versions 1.11 and 1.13.2. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploi...

Acunetix v13 - Web Application Security Scanner

Acunetix, the pioneer in automated web application security software, has announced the release of Acunetix Version 13. The new release comes with an improved user interface and introduces innovations such as the SmartScan engine, malware detection functionality, comprehensive network scanning,...

worksing.icmc.usp.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1086994 Security Researcher haxmov Helped patch 708 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting worksing.icmc.usp.br website...

terrassendach1a.de Improper Access Control vulnerability

Security Researcher error404 Helped patch 524 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting terrassendach1a.de website and its users. Following...

Security Bulletin: Aspera Web Application (Faspex, Console, Orchestrator, Shares) are affected by Apache vulnerabilities (CVE-2019-9517, CVE-2019-10097)

Summary Aspera Web Application Faspex, Console, Shares, Orchestrator have affected the following Apache vulnerabilities. Vulnerability Details CVEID: CVE-2019-9517 DESCRIPTION: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of...

Open-School Community Edition Cross-Site Scripting Vulnerability

Open-School is a web-based school management software. The software offers online billing, attendance and online library.Open-School Community Edition is the community edition of Open-School. A cross-site scripting vulnerability exists in Open-School Community Edition version 2.2. The vulnerabili...

Horde CSV import arbitrary PHP code execution

The HordeData module version 2.1.4 and before present in Horde Groupware version 5.2.22 allows authenticated users to inject arbitrary PHP code thus achieving RCE on the server hosting the web application. Module Options msf use exploit/multi/http/horde/csvrce msf undefinedcsvrce show actions...

CVE-2020-5317

Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious...