3954 matches found
USN-3851-1 python-django vulnerability
It was discovered that Django incorrectly handled the default 404 page. A remote attacker could use this issue to spoof content using a malicious URL...
CVE-2018-20680
Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field...
CVE-2019-0557
A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from...
Apache CouchDB CSRF Vulnerability
Apache CoucDB is open source database software , it has an easy to use and scalable architecture . It has a document-oriented NoSQL database architecture , and concurrency-oriented language Erlang implementation ; it uses JSON to store data , JavaScript using MapReduce as a query language , using...
CVE-2018-20559
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter...
CVE-2018-8918
Cross-site scripting XSS vulnerability in info.cgi in Synology Router Manager SRM before 1.1.7-6941 allows remote attackers to inject arbitrary web script or HTML via the host parameter...
ABB GATE-E1 and GATE-E2 Cross-Site Scripting Vulnerabilities
The ABB GATE-E1 and GATE-E2 are both Ethernet gateway devices from ABB Switzerland. A cross-site scripting vulnerability exists in ABB GATE-E1 EOL 2013 and GATE-E2 EOL OCT 2018, which can be exploited by a remote attacker to inject HTML/Javascript loads into arbitrary device property entries, whi...
The vulnerability of the software for automating testing processes during the development of information systems – IBM Rational Quality Manager – is related to insufficient protection of the website structure. This vulnerability allows attackers to disclose user credentials during a trusted session.
The vulnerability of the IBM Rational Quality Manager software for automating testing processes exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to disclose user credentials during a secure session by injecting...
Stored XSS Vulnerability in Celestial Article Management System
Tianren article management system is a set of asp + access code to build the website system. Tianren Article Management System has a stored XSS vulnerability, which can be exploited by attackers to obtain administrator cookie information...
jenkins: Reflected XSS vulnerability
A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins...
CVE-2018-20018
S-CMS V3.0 has SQL injection via the Sid parameter, as demonstrated by the /1/?type=productinfo&Sid=140 URI...
DOUPHP has a file upload vulnerability
DouPHP is a lightweight enterprise website management system based on PHP+Mysql architecture, running on various platforms such as Linux, Windows, MacOSX, Solaris and so on. DOUPHP suffers from a file upload vulnerability. The vulnerability is caused by the website upload function failing to...
CVE-2018-19927
Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zFormsavechanges sipnick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases...
2018.ecnp.eu XSS vulnerability
Open Bug Bounty ID: OBB-707786 Description| Value ---|--- Affected Website:| 2018.ecnp.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...
Code execution vulnerability in vaeThink php backend
vaeThink is a lightweight, high speed PHP content management framework built on Layui and tp5. A code execution vulnerability exists in the vaeThink php backend. The vulnerability stems from the website's failure to filter php code resulting in arbitrary php code execution, writing a one-sentence...
CVE-2018-11347
The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response from the server, one or several HTTP Header. It requires an interaction with the user to send him the malicious link. It could be used to...
Drobo 5N2 Cross-Site Scripting Vulnerability
The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. A cross-site scripting vulnerability exists in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115. A remote attacker can...
Cisco Prime License Manager SQL Injection Vulnerability
Cisco Prime License Manager PLM is a license manager from Cisco USA. A SQL injection vulnerability exists in the web framework code in Cisco PLM version 11.0.1 and later, which stems from a failure to properly validate user-submitted input in an SQL query statement. A remote attacker can exploit...
FAST or Burp or both?
By @aLLy , Wallarm Research Hello guys, time to talk details about Wallarm FAST Framework for Application Security Testing. It’s a new automatic web vulnerability scanning and fuzzing detection tool by Wallarm Inc. It is well suited for security researchers in enterprise Red Teams as well as for...