Cross site scripting

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are no...

cgbarcelona.galiciaaberta.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1032039 Security Researcher geeknik Helped patch 8803 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

CVE-2019-18381

Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing CORS vulnerability, which is a type of issue that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served...

wedding-staff.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1030552 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

newhols.com Cross Site Scripting vulnerability

Security Researcher Cyberaj Helped patch 3 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting newhols.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty ha...

CVE-2019-5110

Forma LMS 2.2.1 is affected by multiple SQL injection vulnerabilities in authenticated areas. The TALOS advisories confirm exploitable injections in /appCore/index.php (users parameter) and /appLms/ajax.server.php (filter_cat, filter_status) that could allow an attacker to exfiltrate database dat...

CVE-2019-5109

Forma LMS 2.2.1 is affected by SQL injection vulnerabilities in the authenticated portion. The TALOS advisory/TALOS-2019-0902 details SQLi in /appCore/ajax.adm_server.php (dir parameter) and TALOS-2019-0903/0904 describe additional vectors; CVE-2019-5109 covers /appLms/ajax.server.php filter_cat ...

CVE-2019-5112

Forma LMS 2.2.1 is affected by authenticated SQL injection vulnerabilities in the /appLms/ajax.server.php endpoint (parameters filter_cat and filter_status). The TALOS advisory confirms exploitable injections that could lead to exfiltration of database information and, in some configurations, acc...

CVE-2019-18574

RSA Authentication Manager versions prior to 8.4 Patch 8 (8.4.0.8) are affected by a stored cross-site scripting vulnerability in the Security Console. An authenticated Security Console administrator can store arbitrary HTML/JavaScript through the web interface, which may be included in a report ...

angular: Cross-site Scripting (XSS) due to no proper sanitization of xlink:href attributes

A cross-site scripting XSS flaw was found in Angular. This flaw occurs due to improper sanitation of xlink:href attributes, which allows the web application to deliver data to users, along with other trusted content, without proper validation...

CVE-2019-3665

CVE-2019-3665 affects the web interface of McAfee Web Advisor (WA) for versions before 4.1.1.48. The issue is a code injection vulnerability that allows a remote unauthenticated attacker to cause the browser to render websites that WA would normally block when presented via a carefully crafted si...

Arbitrary File Deletion Vulnerability in Super Cms

Super CMS content management system hereinafter referred to as the product by the SEO Research Center in order to solve the problem of website optimization and research and development of a set of products , this product adopts an object-oriented approach to self-help research and development of...

The vulnerability of the JavaScript script handler ChakraCore in Microsoft Edge and Internet Explorer allows a perpetrator to execute arbitrary code.

The vulnerability of the ChakraCore JavaScript script handler in Microsoft Edge and Internet Explorer is related to errors in memory object handling. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially crafted web page...

Intelbras Router RF1200 1.1.3 - Cross-Site Request Forgery

Intelbras Router RF1200 1.1.3 - Cross-Site Request Forgery Exploit Title: Intelbras Router RF1200 1.1.3 - Cross-Site Request Forgery Date: 2019-11-06 Exploit Author: Joas Antonio Vendor Homepage: intelbras.com.br Software Link:...

Forma LMS 2.2.1 /appLms/ajax.server.php filter_cat and filter_status parameters SQL injections

Summary Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

SmartHouse Webapp 6.5.33 - Cross-Site Request Forgery

Exploit Title: SmartHouse Webapp 6.5.33 - Cross-Site Request Forgery Discovery by: LiquidWorm Date: 2019-12-02 Vendor Homepage: Tested Version: 6.5.33.17072501 CVE: N/A Advisory ID: ZSL-2019-5543 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5543.php Carlo Gavazzi SmartHous...

kocaeliolay.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1026681 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting kocaeliolay.com website a...

CVE-2019-13935

The CVE-2019-13935 issue affects Siemens Polarion webclient prior to version 19.2. It is a reflected XSS vulnerability caused by improper input validation in the web application, allowing execution of client-side code. Impact is limited to the browser context; no server-side compromise documented...

New Relic: Disclosure of locally served nerdpacks due to nr-local.net CORS policy misconfiguration

Hey team, I've discovered that webserver which serves NR1 nerdpacks locally after nr1 nerdpack:serve is executed allows cross-origin requests from every subdomain of nr-ext.net. Since the nr-ext.net domain is used as a sandbox for user-supplied apps, an attacker can place there a malicious code...

CVE-2019-15956

A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability is due to improper authorization controls for a specific UR...