7437 matches found
Cross-site Scripting (XSS) - Reflected in bigprof-software/online-invoicing-system
✍️ Description /app/admin/pageTransferOwnership.php with sourceMemberID parameter is vulnerable to Reflected XSS. Line 216 of pageTransferOwnership.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at builtinecho in...
JVN#15185184: IkaIka RSS Reader vulnerable to cross-site scripting
IkaIka RSS Reader contains a cross-site scripting vulnerability CWE-79, due to the improper processing of RSS registration. Impact If a malicious RSS feed is loaded into the product, an arbitrary script may be executed on the web browser where the product is running. Solution Do not use IkaIka RS...
Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp
✍️ Description GET parameter ?plugin= of plugin.php is vulnerable to reflected cross site scripting. plugin.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at printf in plugin.php 🕵️♂️ Proof of Concept 1. Visit...
CVE-2021-3314
Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for...
Code injection
UNSUPPORTED WHEN ASSIGNED Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most...
CVE-2021-3314
Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for...
CVE-2021-3314
Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for...
CVE-2021-29960
The CVE-2021-29960 entry concerns Mozilla Firefox before version 89. The issue is an information disclosure where Firefox caches the last filename used for printing and often uses the web page title as the suggested print filename. The combination of caching and title suggestion could allow the t...
JVN#63066062: WordPress Plugin "WordPress Popular Posts" vulnerable to cross-site scripting
WordPress Plugin "WordPress Popular Posts" provided by Hector Cabrera contains a cross-site scripting vulnerability CWE-79. Impact A user with the administrative privilege may unintentionally execute a script on his/her web browser. Solution Update the plugin Update the plugin according to the...
Google Chrome suffers from an information disclosure vulnerability (CNVD-2021-47672)
Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an information disclosure vulnerability. A remote attacker can exploit the vulnerability to obtain potentially sensitive information from process memory via specially crafted PDF files...
JVN#03776901: Hitachi Application Server Help vulnerable cross-site scripting
Hitachi Application Server Help contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Apply the appropriate latest version of the help according to the information provided by the developer. Product...
Fedora: Security Advisory for firefox (FEDORA-2021-af55f610eb)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-27485
ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to retrieve the credentials from the web browser...
CVE-2021-27485
ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to retrieve the credentials from the web browser...
Format string
ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to retrieve the credentials from the web browser...
CVE-2021-27485
ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to retrieve the credentials from the web browser...
Ec-cube 跨站脚本漏洞
Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A cross-site scripting vulnerability exists in Ec-Cube, which can be exploited by a remote attacker to inject specially crafted scripts into specific input fields of an EC website created using EC-Cube and execute...
firefox security update
CentOS Errata and Security Advisory CESA-2021:2206 An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Unable to launch a VDI (second hop) within a active VDI session (first hop), error “An incorrect pin was presented to the security device”
The customer has FAS in place and it is working fine They are testing the VDI sessions and users can launch Desktops when using their workstations endpoints If they try to launch a second Desktop session second hop within the current VDI session using CWA, they get an error “An incorrect pin was...
