Mozilla: Attacker-induced prompt for extension installation

By holding a reference to the eval function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious...

XSS vulnerability in Yixing YiFa cms

Yixing Yifa Network Service Co., Ltd. is a company that provides Internet solutions for enterprises, providing a variety of information products and services, such as website construction, WeChat public platform, WeChat marketing, website promotion, website maintenance and operation, domain name...

Nextcloud Desktop Client Cross-Site Scripting Vulnerability

Nextcloud is a suite of client-server software for creating file hosting services and using them.Nextcloud Desktop Client is the Nextcloud desktop client. A cross-site scripting vulnerability exists in Nextcloud Desktop Client 2.6.4. An attacker can exploit this vulnerability via an invalid serve...

The vulnerability of the Knowledge Management component of the SAP NetWeaver software integration platform allows attackers to execute cross-site scripting attacks.

The vulnerability of the Knowledge Management component of the SAP NetWeaver software integration platform is related to the failure to take measures to eliminate script-related tags on web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

theblurb.ca Cross Site Scripting vulnerability OBB-1259335

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

The vulnerability of the Tile Server component of the Oracle Fusion Middleware MapViewer software allows a intruder to gain access to modify, add, or delete data.

The vulnerability of the Tile Server component of the Oracle Fusion Middleware MapViewer visualization software relates to the lack of security measures for the web page structure. Exploiting this vulnerability allows a malicious actor to remotely access and modify, add, or delete data using the...

Destoon B2B Content Management System Backend File Inclusion Vulnerability

DESTOON® B2B Website Management System is an open source B2B e-commerce industry portal solution based on PHP+MySQL. A file inclusion vulnerability exists in the backend of the Destoon B2B content management system, which can be exploited by attackers to gain server administrative privileges...

Exploit for CVE-2015-0273

phpcodz Php Codz Hacking http://www.80vul.com/pch/ What is PHP? PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. If you are new to PHP and want to get some idea of how it works, try the introductory tutorial. Afte...

Stored Cross-Site Scripting Vulnerability in RGCMS Frontend In***.php File

RuiGu information management system RGCMS is a set of open source building management system, using PHP language, written in the framework of Thinkphp5.1.+, the database using MYSQL database. RGCMS front In.php file exists stored cross-site scripting vulnerability. Attackers can use this...

CVE-2020-4410

IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to send a specially crafted HTTP GET request to read attachments on the server that they should not have access to. IBM X-Force ID: 179539...

Code Execution Vulnerability in CLTPHP Content Management System

CLTPHP Content Management System is a PHP content management system for building websites efficiently. A code execution vulnerability exists in CLTPHP Content Management System, which can be exploited by attackers to gain server privileges...

IBM Intelligent Operations Center Cross-Site Scripting Vulnerability (CNVD-2020-50797)

IBM Intelligent Operations Center IOC is a suite of city operations solutions from IBM in the United States. The product features data visualization and real-time collaboration. A cross-site scripting vulnerability exists in IBM Intelligent Operations Center, which can be exploited by an attacker...

Command Execution Vulnerability in ZZCMS

ZZCMS is an asp language development of the site building system. ZZCMS has a command execution vulnerability that can be exploited by an attacker to execute arbitrary commands to obtain server control privileges...

D-Link DIR-816L Cross-Site Scripting Vulnerability

The D-Link DIR-816L is a wireless AC750 dual-band cloud router. A cross-site scripting vulnerability exists in the D-Link DIR-816L. The vulnerability stems from the webinc/js/info.php file printing the RESULT parameter on a web page without applying any output filter. An attacker can exploit this...

SQL Injection Vulnerability in LJCMS of Beijing Liangjing Zhicheng Technology Co.

LJCMS adopts PHP + Mysql architecture, is a very SEO friendly, full-featured, safe and stable, support multi-terminal display and extremely simple to use enterprise station building system. LJCMS has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database...

UBUNTU-CVE-2020-6516

Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Wing FTP Server 6.3.8 Remote Code Execution

Exploit Title: Wing FTP Server 6.3.8 - Remote Code Execution Authenticated Date: 2020-06-26 Exploit Author: v1n1v131r4 Vendor Homepage: https://www.wftpserver.com/ Software Link: https://www.wftpserver.com/download.htm Version: 6.3.8 Tested on: Windows 10 CVE : -- Wing FTP Server have a web conso...

File Inclusion Vulnerability in HisiPHP

HisiPHP is based on ThinkPHP5 + Layui development of a set of free WEB open source framework. HisiPHP has a file inclusion vulnerability. Attackers can use the vulnerability to obtain server privileges...

Path traversal

In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to...

CVE-2020-6164

In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to...