Missing HTTP Security Headers

keycloak does not contain security headers in its server responses. The lack of these headers does not directly lead to a vulnerability, however it reduces the restrictions of an attacker and aids them in their efforts in the event of a successful exploit of a web vulnerability...

Cross-site scripting vulnerability in multiple NETGEAR products (CNVD-2020-26945)

NETGEAR D7800 and others are products of NETGEAR, Inc.NETGEAR D7800 is a wireless modem.NETGEAR R7500 is a wireless router.NETGEAR XR500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless...

Arbitrary File Read Vulnerability in EDI CMS

ETA CMS is a simple, practical and efficient website builder. ETA CMS has an arbitrary file read vulnerability that can be exploited by an attacker to read configuration files on the server...

Arbitrary File Deletion Vulnerability in Aptar CMS

Aptar CMS is a website management system with PHP+MYSQL technology. Aptar CMS has an arbitrary file deletion vulnerability that can be exploited by an attacker to delete arbitrary files...

SeedDMS v5.1.18 - Multiple Persistent Web Vulnerabilities

Document Title: =============== SeedDMS v5.1.18 - Multiple Persistent Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2209 Release Date: ============= 2020-04-14 Vulnerability Laboratory ID VL-ID: ====================================...

Vastgota-Data ProVide Cross-Site Request Forgery Vulnerability

Vastgota-Data ProVide is a file transfer server with a graphical user interface from Vastgota-Data, Sweden. A cross-site request forgery vulnerability exists in Vastgota-Data ProVide version 13.1 and earlier. The vulnerability stems from a WEB application that does not adequately validate that a...

PT-2020-19673 · None · Class-Transformer

Name of the Vulnerable Software and Affected Versions: class-transformer versions prior to 0.3.1 Description: The issue allows attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payloa...

CVE-2020-5552

Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries...

XSS Vulnerability in Extreme CMS

Extreme CMS is open source and free PHPCMS web content management system. Extreme CMS has an XSS vulnerability that can be exploited by attackers to obtain administrator cookie information...

wifidanang.net Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1122271 Security Researcher geeknik Helped patch 8930 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting wifidanang.net website and...

Systech NDS-5008 Cross-Site Scripting Vulnerability

The Systech NDS-5008 is a terminal server from Systech USA. A cross-site scripting vulnerability exists in the Systech NDS-5000 Terminal Server NDS/5008 8 Port, RJ45 using firmware version 02D.30. The vulnerability stems from the lack of proper validation of client data by the WEB application. An...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-18551)

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A cross-site scripting vulnerability exists in Ignite Realtime Openfire 4.4.1. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via the...

The vulnerability in the J-Web web interface of the JunOS operating system allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability in the J-Web web interface of the JunOS operating system is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

CVE-2019-16065

A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to expose and compromise the web server, expose database tables and values, and potentially execute system-based commands as the mysql user...

CVE-2019-16065

The CVE-2019-16065 entry concerns a remote SQL injection in Enigma NMS 65.0.0 and earlier web applications. Vulnerable component: manage_hosts_short.cgi parameter search_pattern (web CGI). Underlying issue: SQL injection in the web interface could allow an attacker to run SQL commands to extract ...

Dolibarr ERP/CRM Cross-Site Scripting Vulnerability (CNVD-2020-21491)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site scripting vulnerability exists in the user/card.p...

Chadha Software Technologies PHPKB Standard Multi-Language Cross-Site Request Forgery Vulnerability (CNVD-2020-17144)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A cross-site request forgery vulnerability exists in Chadha Software Technologies PHPKB Standard Multi-Language. The vulnerability...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-17937)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflected cross-site scripting vulnerability exists in admin/reply-ticket.php in Chadha PHPKB Standard Multi-Language version 9. T...

Chadha Software Technologies PHPKB Standard Multi-Language Cross-Site Request Forgery Vulnerability (CNVD-2020-17152)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A cross-site request forgery vulnerability exists in Chadha Software Technologies PHPKB Standard Multi-Language. The vulnerability...