CVE-2019-5117

CVE-2019-5117 corresponds to an authenticated SQL injection in YouPHPTube 7.6, specifically in /objects/subscribe.json.php (parameter user_id). Exploitation requires being logged in; a crafted request can exfiltrate database content and user credentials, with potential OS access in some configura...

CVE-2019-5116

CVE-2019-5116 is a SQL injection vulnerability in YouPHPTube 7.6, present in the authenticated portion of the application. The TALOS/YouPHPTube advisory describes an exploitable flaw in the /objects/videoAddNew.json.php endpoint (parameter categories_id) that can exfiltrate database information (...

Wordpress Groundhogg SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Wordpress Groundhogg suffers from a SQL injection vulnerability that can be exploited by attackers to execute illegal SQL...

CVE-2019-18419

The provided connected records confirm CVE-2019-18419 is a cross-site scripting (XSS) flaw in ClonOS WEB control panel 19.09, specifically in index.php with the lang parameter. Root cause is described in CNVD as lack of proper validation of client-side data, enabling injection of arbitrary script...

depts.valleycollege.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1002854 Security Researcher devl00p Helped patch 3000 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting depts.valleycollege.edu...

CVE-2019-10475

CVE-2019-10475 affects Jenkins’ build-metrics plugin (1.3 and earlier). It is a reflected cross-site scripting vulnerability where the plugin does not properly escape the label query parameter, allowing an attacker to inject arbitrary HTML/JavaScript into the plugin’s web pages. Impact is user’s ...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

Awesome Web Security 🐶 Curated list of Web Security materials and resources. Needless to say, most websites suffer from various types of bugs which may eventually lead to vulnerabilities. Why would this happen so often? There can be many factors involved including misconfiguration, shortage of...

seasons.org Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8505 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting seasons.org website and its users. Following coordinated a...

Accounts Accounting 7.02 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Express Accounts Accounting 7.02 - Persistent Cross-Site Scripting Exploit Author: Debashis Pal Vendor Homepage: https://www.nchsoftware.com Source: https://www.nchsoftware.com/accounting/index.html Version: Express Accounts...

IceWarp Mail Server Cross-Site Scripting Vulnerability (CNVD-2019-36911)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports e-mail archiving, SmartAttach attachments, automatic migration, etc. IceWarp Webclient is a Web-based IceWarp client program. A cross-site scripting vulnerability exists in IceWarp Webclient versions prior to...

Oracle Java SE/Java SE Embedded CVE-2019-2962 Remote Security Vulnerability

Description Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. The vulnerability can be exploited over Multiple protocols. This issue affects the '2D' component. This vulnerability affects the following supported versions: Java SE: 7u231, 8u221, 11.0.4, 13; Java SE...

Oracle Java SE/Java SE Embedded CVE-2019-2981 Remote Security Vulnerability

Description Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. The vulnerability can be exploited over Multiple protocols. This issue affects the 'JAXP' component. This vulnerability affects the following supported versions: Java SE: 7u231, 8u221, 11.0.4, 13; Java S...

eco-agenda.yildiz.edu.tr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-994479 Security Researcher Gh05tPT Helped patch 6901 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting eco-agenda.yildiz.edu.tr...

CVE-2019-17537

Jiangnan Online Judge aka jnoj 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substring...

CVE-2019-17537

The CVE-2019-17537 entry concerns Jiangnan Online Judge (jnoj) v0.8.0, which is affected by a Directory Traversal vulnerability in the web endpoint web/polygon/problem/deletefile?id=1&name=../ that enables arbitrary file deletion. Root cause stated across sources is improper/unsanitized path hand...

arundel.mdwg.cap.gov Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-991101 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2019-17490

app\modules\polygon\controllers\ProblemController in Jiangnan Online Judge aka jnoj 0.8.0 allows arbitrary file upload, as demonstrated by PHP code with a .php filename but the image/png content type to the web/polygon/problem/tests URI...

CVE-2019-17489

Jiangnan Online Judge (jnoj) 0.8.0 is affected by a Cross-Site Scripting (XSS) flaw that can be triggered via the Problem[title] field on the endpoints web/polygon/problem/create, web/polygon/problem/update, or web/admin/problem/create. The root cause is unvalidated client-side data in these web ...

HCL AppScan Source Code Issue Vulnerability

HCL AppScan Source is a suite of dynamic analysis and testing tools from HCL India, which is mainly used for web security testing. A code issue vulnerability exists in HCL AppScan Source versions prior to 9.03.13. The vulnerability stems from an improperly designed or implemented code development...

Bludit Brute Force Protection Mechanism Bypass Vulnerability

Bludit is a simple, fast and secure flat file CMS. A brute force protection mechanism bypass vulnerability exists in bl-kernel/security.class.php in Bludit 3.9.2, which can be exploited by an attacker to bypass the brute force protection mechanism via a variety of forged X-Forwarded-For or...