CVE-2021-40191

CVE-2021-40191 affects Dzzoffice 2.02.1 with a cross-site scripting (XSS) flaw caused by insufficient sanitization of input data across all upload functions in webroot/dzz/attach/Uploader.class.php, and a misconstructed output content-type in webroot/dzz/attach/controller.php. The issue is docume...

All Vulnerabilities for administracioneducaciononline.uta.edu.ec Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| administracioneducaciononline.uta.edu.e...

django-unicorn 0.35.3 - Stored Cross-Site Scripting Vulnerability

Exploit Title: django-unicorn 0.35.3 - Stored Cross-Site Scripting XSS Exploit Author: Raven Security Associates, Inc. ravensecurity.net Software Link: https://pypi.org/project/django-unicorn/ Version: = 0.35.3 CVE: CVE-2021-42053 django-unicorn = 0.35.3 suffers from a stored XSS vulnerability by...

CVE-2020-21729

CVE-2020-21729 affects JEECMS (x1.1). The vulnerability is a stored XSS in the /member-vipcenter.htm component, allowing an attacker to inject and execute arbitrary web scripts or HTML via a crafted payload. The issue stems from unvalidated input on that page. Documented impact is client-side cod...

Online Traffic Offense Management System 1.0 - Multiple SQL Injection Vulnerability

Exploit Title: Online Traffic Offense Management System 1.0 - Multiple SQL Injection Unauthenticated Exploit Author: Hubert Wojciechowski Contact Author: email protected Vendor Homepage: https://www.sourcecodester.com Software Link:...

Online Traffic Offense Management System 1.0 - Multiple XSS Vulnerability

Exploit Title: Online Traffic Offense Management System 1.0 - Multiple XSS Unauthenticated Exploit Author: Hubert Wojciechowski Contact Author: email protected Vendor Homepage: https://www.sourcecodester.com Software Link:...

CVE-2021-34698

A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service DoS condition on an affected device. This vulnerability is due to improper memory management in the pro...

Design/Logic Flaw

A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service DoS condition on an affected device. This vulnerability is due to improper memory management in the pro...

CVE-2021-34698 Cisco Web Security Appliance Proxy Service Denial of Service Vulnerability

A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service DoS condition on an affected device. This vulnerability is due to improper memory management in the pro...

CVE-2021-34698

A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service DoS condition on an affected device. This vulnerability is due to improper memory management in the pro...

Cisco Web Security Appliance Proxy Service Denial of Service Vulnerability

A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service DoS condition on an affected device. This vulnerability is due to improper memory management in the pro...

Mail.ru: OS command injection on seedr.ru

site: https://seedr.ru The seedid parameter be vulnerable to OS command injection attacks. It is possible to use various shell metacharacters to inject arbitrary OS commands. The command output does not appear to be returned in the application's responses, however it is possible to inject time...

CVE-2021-41554

ARCHIBUS Web Central 21.3.3.815 suffers improper access control: requests to /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw, and /archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw do not verify p...

CVE-2020-21495

CVE-2020-21495 is an XSS vulnerability in Xiuno BBS 4.0.4 affecting the /admin/?setting-base.htm page, caused by inadequate handling of the sitename parameter. The vulnerability allows an attacker to inject and execute arbitrary web scripts/HTML in the context of the affected site. The provided c...

Young Entrepreneur E-Negosyo System 1.0 Cross Site Scripting

Exploit Title: Young Entrepreneur E-Negosyo System 1.0 - 'PRODESC' Stored Cross-Site Scripting XSS Date: 2021-10-03 Exploit Author: Jordan Glover Vendor Homepage: https://www.sourcecodester.com/php/12684/young-entrepreneur-e-negosyo-system.html Software Link:...

CVE-2021-41462

CVE-2021-41462 : In concrete5-legacy versions ≤ 5.6.4.0, a cross-site scripting (XSS) flaw exists in concrete/elements/collection_add.php via the ctID parameter. This allows remote attackers to inject arbitrary web script or HTML. The affected product is concrete5-legacy 5.6.4.0 and earlier. The ...

CVE-2021-41463

Cross-site scripting (XSS) vulnerability in concrete5-legacy 5.6.4.0 and earlier exists in the toos/permissions/dialogs/access/entity/types/group_combination.php file. The cID parameter can be exploited by remote attackers to inject arbitrary web script or HTML. This CVE’s documented impact is li...

CVE-2021-40970

CVE-2021-40970 affectsSpotweb

CVE-2021-40927

CVE-2021-40927 is an XSS vulnerability in the Spotify-for-Alfred project (callback.php) affecting version 0.13.9 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via the error parameter. According to NVD metrics, the exploitability is network-based with medium ...

CVE-2021-40924

CVE-2021-40924 documents a cross-site scripting (XSS) vulnerability in the Bugs/Tinyissue project. The issue affects install/index.php for bugs versions 1.8 and earlier, where the first_name parameter can be abused to inject arbitrary web script or HTML. The connected sources consistently describ...