Crunchbase Cognitoys Dino Cross-Site Request Forgery Vulnerability

Crunchbase Cognitoys Dino is a children's cognitive electronic learning toy from Crunchbase USA. A cross-site request forgery vulnerability exists in the Crunchbase Cognitoys Dino device. The vulnerability stems from the WEB application not adequately verifying that a request is from a trusted...

cPanel cross-site scripting vulnerability (CNVD-2019-28987)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the listftpstable AP in versions prior to cPanel 60.0.25. The vulnerabili...

TeamPass <= 2.1.27.36 Multiple XSS Vulnerabilities

TeamPass is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2019-1954 Cisco Webex Meetings Server Open Redirection Vulnerability

A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to...

Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income)

Daily Expense Manager 1.0 - Cross-Site Request Forgery Delete Income Exploit Title: Daily Expense Manager - CSRF Delete Income Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: August 8, 2019 Vendor Homepage: https://sourceforge.net/projects/daily-expense-manager...

SQL Injection Vulnerability in ASK2 Q&A System Ap***.php File

ASK2 Q&A is an open source PHP Q&A program. ASK2 Q&A System Ap.php file has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Open-School Cross-Site Scripting Vulnerability

Open-School is a web-based school management software. The software offers online billing, attendance and online library.Open-School Community Edition is the community edition of Open-School. A cross-site scripting vulnerability exists in Open-School version 3.0 and Community Edition version 2.3...

TeamPass Cross-Site Scripting Vulnerability (CNVD-2020-16615)

TeamPass is an open source password manager. A cross-site scripting vulnerability exists in TeamPass version 2.1.27.35, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute client-side code...

Nature Easy Soft Network Technology ZenTao Cross-Site Scripting Vulnerability

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management and other...

College Notes Management System 1.0 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: College Notes Management System 1.0 - CSRF Add Note Exploit Author: Mr Winst0n Author E-mail: email protected Vendor Homepage: https://anirbandutta.ml/ Software Link: https://sourceforge.net/projects/college-notes-management/...

Top 10 Practices for Securing Cloud Workloads

Public cloud is one of the biggest challenges in every IT organization. While driving greater scalability, performance, and access for a competitive edge, it also introduces new security risks. More than just hosted data center infrastructure, public cloud offers the promise of agility, efficienc...

cPanel cross-site scripting vulnerability (CNVD-2019-26352)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in versions prior to cPanel 70.0.23. The vulnerability stems from a lack of proper...

Gogs < 0.11.91 Improper Access Vulnerability

Gogs is prone to an improper access vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Invenio-records Cross-Site Scripting Vulnerability

invenio-records is a metadata storage module. A cross-site scripting vulnerability exists in versions of invenio-records prior to 1.2.2. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...

Opengear console server cross-site scripting vulnerability

Opengear console server is a console server from Opengear USA. It is capable of managing network, server, and power infrastructures with monitoring, troubleshooting, and remediation features. A cross-site scripting vulnerability exists in the Opengear console server using firmware versions prior ...

What We Can Learn from the Capital One Hack

On Monday, a former Amazon employee was arrested and charged with stealing more than 100 million consumer applications for credit from Capital One. Since then, many have speculated the breach was perhaps the result of a previously unknown "zero-day" flaw, or an "insider" attack in which the accus...

Qualys Cloud Platform 2.40 New Features

This release of the Qualys Cloud Platform version 2.40 includes updates and new features for Web Application Scanning, highlights as follows. Web Application Scanning "Everything" Detection Scope – A new detection scope called "Everything" is now available in the option profile. This can be used ...

College Notes Management System 1.0 Cross Site Request Forgery

Exploit Title: College Notes Management System 1.0 - CSRF Add Note Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: August 3, 2019 Vendor Homepage: https://anirbandutta.ml/ Software Link: https://sourceforge.net/projects/college-notes-management/ Software Link:...

Sar2HTML 3.2.1 - Remote Command Execution

Sar2HTML 3.2.1 - Remote Command Execution Exploit Title: sar2html Remote Code Execution Date: 01/08/2019 Exploit Author: Furkan KAYAPINAR Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Centos 7 In web...

Sar2HTML 3.2.1 - Remote Command Execution

Exploit Title: sar2html Remote Code Execution Date: 01/08/2019 Exploit Author: Furkan KAYAPINAR Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Centos 7 In web application you will see index.php?plot url...