CVE-2019-9537

CVE-2019-9537 concerns Telos Automated Message Handling System (AMHS). The vulnerability is an improper neutralization of input in uploaditem.asp, enabling a remote attacker to inject arbitrary script into an AMHS session (cross-site scripting). Affected versions are AMHS before 4.1.5.5. Several ...

CVE-2013-1642

QuiXplorer (before 2.5.5) is affected by multiple XSS vulnerabilities. The issue enables remote attackers to inject arbitrary web script or HTML via parameters (dir, item, order, searchitem, selitems[], srt) to index.php or via QUERY_STRING. Impact includes possible client-side script execution; ...

CVE-2013-7062

CVE-2013-7062 concerns multiple cross-site scripting (XSS) vulnerabilities in Zope used by Plone 3.3.x–3.3.6, 4.0.x–4.0.9, 4.1.x–4.1.6, 4.2.x–4.2.7, and 4.3–4.3.2. The issue arises from input that is not properly filtered in two components: (1) browser_id_manager and (2) OFS.Image, enabling remot...

historisches-festmahl.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1057250 Security Researcher error404 Helped patch 534 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting historisches-festmahl.de...

CVE-2019-19734

accountmovefileinfolder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection...

Heatmiser Netmonitor 3.03 - Hardcoded Credentials

Heatmiser Netmonitor 3.03 - Hardcoded Credentials Exploit Title: Heatmiser Netmonitor 3.03 - Hardcoded Credentials Date: 2019-12-22 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.heatmiser.com/en/ Hardware Link: https://www.zoneregeling.nl/heatmiser/netmonitor-handleiding.pdf...

nvlinens.com Cross Site Scripting vulnerability

Security Researcher error404 Helped patch 522 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting nvlinens.com website and its users. Following coordinated...

umweltdigital.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1052790 Security Researcher howardpotts Helped patch 172 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting umweltdigital.de website and its users. Following...

AVE DOMINAplus 1.10.x Cross Site Request Forgery / Cross Site Scripting

AVE DOMINAplus =1.10.x CSRF/XSS Vulnerabilities Vendor: AVE S.p.A. Product web page: https://www.ave.it | https://www.domoticaplus.it Affected version: Web Server Code 53AB-WBS - 1.10.62 Touch Screen Code TS01 - 1.0.65 Touch Screen Code TS03x-V | TS04X-V - 1.10.45a Touch Screen Code TS05 - 1.10.3...

xzagorov.webzdarma.cz Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1051994 Security Researcher Fadavvi Helped patch 80 vulnerabilities Received 4 Coordinated Disclosure badges Received 1 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting xzagorov.webzdarma.cz website...

CVE-2019-6018

NetCommons3.x (NetCommons 3.2.2 and earlier) is affected by a cross-site scripting (XSS) vulnerability (CWE-79). The issue arises from insufficient validation of client data in the web application, allowing an attacker to inject arbitrary script/HTML into users’ browsers. Affected versions includ...

CVE-2019-6011

CVE-2019-6011 is a confirmed cross-site scripting vulnerability in the WordPress plugin wpDataTables Lite, affecting version 2.0.11 and earlier. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, potentially impacting users who load affected pages. T...

25400021084.amanbo.co.ke Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1051715 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

rabakehair.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1048272 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

australianinvestor.com.au Cross Site Scripting vulnerability

Security Researcher g0bl1nsec Helped patch 3608 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting australianinvestor.com.au website and its users. Followin...

U.S. Dept Of Defense: Leaked DB credentials on https://██████████.mil/███

Summary: Information disclosure with login credentials for ms-sql database exposed. Description: I've found a PHP info file disclosed on https://█████.mil/██████ containing login credentials for a database cloud server ███████ as well as information on the host system such as hostname, username a...

Arbitrary File Deletion Vulnerability in Ocean CMS Backend

Ocean CMS is a web content management system based on PHP+MYSQL architecture that can run across platforms. Ocean CMS backend there are arbitrary file deletion vulnerability, attackers can use the vulnerability to delete any file...

Backdrop CMS Cross-Site Scripting Vulnerability (CNVD-2020-03710)

Backdrop CMS is a simple, open source, easy-to-use lightweight content management system for building attractive, professional websites. A cross-site scripting vulnerability exists in Backdrop CMS. The vulnerability stems from Backdrop CMS failing to adequately filter output when displaying...

CVE-2019-8813

A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting...

CVE-2019-8769

An issue existed in the drawing of web page elements. The issue was addressed with improved logic. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Visiting a maliciously crafted website may reveal browsing history...