Telerik UI for ASP.NET AJAX RadChart Path Traversal Vulnerability

Telerik UI for ASP.NET AJAX is an HTML editor. RadChart is one of the charting components. A path traversal vulnerability exists in RadChart in Telerik UI for ASP.NET AJAX. The vulnerability stems from a failure of a network system or product to properly filter special elements in the path of a...

apps.webware.io Cross Site Scripting vulnerability

Security Researcher devl00p Helped patch 2581 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting apps.webware.io website and its users. Following...

CVE-2019-13943

A vulnerability has been identified in EN100 Ethernet module DNP3 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module IEC104 variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO variant A...

CVE-2019-13932

A vulnerability has been identified in XHQ All versions V6.0.0.2. The web application requests could be manipulated, causing the the application to behave in unexpected ways for legitimate users. Successful exploitation does not require for an attacker to be authenticated. A successful attack cou...

Code injection

A vulnerability has been identified in XHQ All versions V6.0.0.2. The web interface could allow for an an attacker to craft the input in a form that is not expected, causing the application to behave in unexpected ways for legitimate users. Successful exploitation requires for an attacker to be...

Code injection

A vulnerability has been identified in XHQ All versions V6.0.0.2. The web application requests could be manipulated, causing the the application to behave in unexpected ways for legitimate users. Successful exploitation does not require for an attacker to be authenticated. A successful attack cou...

CVE-2019-13932

CVE-2019-13932 affects Siemens XHQ Operations Intelligence: all versions before 6.0.0.2 are vulnerable due to an IMPROPER INPUT VALIDATION (CWE-20) in the web interface. This could allow an unauthenticated attacker to manipulate web requests and potentially read or modify contents within the web ...

CVE-2019-13943

A vulnerability has been identified in EN100 Ethernet module DNP3 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module IEC104 variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO variant A...

CVE-2019-13931

A vulnerability has been identified in XHQ All versions V6.0.0.2. The web interface could allow for an an attacker to craft the input in a form that is not expected, causing the application to behave in unexpected ways for legitimate users. Successful exploitation requires for an attacker to be...

CVE-2019-13943

CVE-2019-13943 affects Siemens EN100 Ethernet Module variants (DNP3, IEC61850

UBUNTU-CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

statusnet cross-site scripting vulnerability (CNVD-2020-04299)

statusnet is an open source micro-blogging program written in PHP. A cross-site scripting vulnerability exists in versions of statusnet prior to 0.9.9. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability to...

Server side request forgery (ssrf)

Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a server-side request forgery SSRF exploit, which is a type of issue that can let an attacker send crafted requests from the backend server of a vulnerable web application or access services available through the loopback interfac...

CVE-2019-11016: Open Redirect Vulnerability

Earlier this year the Qualys Web Application Scanning team discovered and reported an open redirect vulnerability CVE-2019-11016 in Elgg, an open source rapid development framework for socially aware web applications, which the Elgg team promptly fixed. Versions of the Elgg framework before 1.12....

DAViCal CalDAV Server Cross-Site Scripting Vulnerability

DAViCal is a calendar sharing server that is an implementation of the CalDAV protocol. A cross-site scripting vulnerability exists in DAViCal CalDAV Server version 1.1.8 and earlier. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker can...

Documize Cross-Site Scripting Vulnerability

Documize is an open source document collaboration system built on Golang and EmberJS. A cross-site scripting vulnerability exists in the domain/section/markdown/markdown.go file in Documize versions prior to 3.5.1. The vulnerability stems from the lack of proper validation of client-side data by...

ZZZphp sa***.php page ti*** parameter has SQL injection vulnerability

ZZZphp is a PHP and MYSQL based on free open source website building system . ZZZphp sa.php page ti parameters exist SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

forma.lms <= 2.2.1 Multiple SQL Injection Vulnerabilities

Forma Learning Management System is prone to multiple SQL injection vulnerabilities. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as...

SCEditor Cross-Site Scripting Vulnerability

SCEditor is a WYSIWYG editor. A cross-site scripting vulnerability exists in SCEditor version 2.1.3, which stems from the lack of proper validation of client-side data in a WEB application and can be exploited by an attacker to execute client-side code...

DAViCal Cross-Site Request Forgery Vulnerability

DAViCal is a calendar sharing server that is an implementation of the CalDAV protocol. A cross-site request forgery vulnerability exists in DAViCal 1.1.8 and earlier versions. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted...