Simplejobscript.com SJS controllers/page_apply.php script upload vulnerability

Simplejobscript.com SJS is a WEB based recruitment application service program. A security vulnerability exists in Simplejobscript.com SJS controllers/pageapply.php at the upload of resumes, which can be exploited by remote attackers to submit a special PHP script request to upload and execute...

AKCMS suffers from a command execution vulnerability (CNVD-2020-10179)

AKCMS is a lightweight content management system based on PHP and MySQL. A command execution vulnerability exists in AKCMS, which can be exploited by attackers to execute commands and gain server privileges...

ZOHO ManageEngine ServiceDesk Plus Reflective Cross-Site Scripting Vulnerability

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A reflective...

sofagoodsofa.com.hk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1066463 Security Researcher Zodx Helped patch 35 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting sofagoodsofa.com.hk website and its users. Following...

RICOH SP C250DN Cross-Site Request Forgery Vulnerability

The RICOH SP C250DN is a printer from the Japanese company Ricoh RICOH. A cross-site request forgery vulnerability exists in RICOH SP C250DN version 1.06. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker cou...

Juniper Networks Junos OS Cross-Site Scripting Vulnerability (CNVD-2020-03713)

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The OS provides a secure programming interface and the Junos SDK. A cross-site scripting vulnerability exists in J-Web in Juniper Networks Junos OS, which arises from a lack of proper...

XSS Vulnerability in the User Registration Page of Angel School's Training Website System

Angel school training website system is an open source website management system. Angel school training website system user registration page has an XSS vulnerability that can be exploited by attackers to execute malicious script code...

Red Hat CloudForms Management Engine Cross-Site Request Forgery Vulnerability (CNVD-2020-01942)

Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure as a Service cloud service solutions from Red Hat, Inc. A cross-site request forgery vulnerability exists in Red Hat CFME, which arises from a WEB application that does not adequately validate that a request ...

jenkins-2-plugins: Stored XSS vulnerability in HTML Publisher Plugin

Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those...

XSS Vulnerability in Cool Arts Culture Website Building System

Cool Art Culture Network Technology Co., Ltd. is a network service organization focusing on high-end website construction and brand communication. There is an XSS vulnerability in the Cool Art Culture website builder system, which can be exploited by attackers to inject arbitrary Web scripts or...

Google Chrome Input Validation Error Vulnerability (CNVD-2019-46432)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an input validation error vulnerability. An attacker can exploit this vulnerability to spoof domain names with the help of specially crafted HTML pages...

Google Chrome Input Validation Error Vulnerability (CNVD-2019-46751)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an input validation error vulnerability. An attacker can exploit this vulnerability to cause heap corruption with the help of specially crafted HTML pages...

SQL Injection Vulnerability in Changzhou Shengke Network Technology Co.

Changzhou Shengke Network Technology Co., Ltd. is the industry's leading technology and unique creativity to provide enterprises with a total solution for website construction company. Changzhou Shengke Network Technology Co., Ltd. website construction system there are SQL injection...

File Inclusion Vulnerability in hongcms

HongCMS Chinese and English website system is a lightweight free open source website system for building various types of Chinese and English websites, while it is a small development framework. hongcms file inclusion vulnerability , an attacker can exploit the vulnerability to arbitrarily includ...

CVE-2019-19493

Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS...

flyview.uni-muenster.de Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1028227 Security Researcher fakessh Helped patch 1840 vulnerabilities Received 9 Coordinated Disclosure badges Received 60 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting flyview.uni-muenster.de...

Centreon Web SQL Injection Vulnerability

Centreon Web is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions on the network , system and application resources . A SQL injection vulnerability exists in Centreon Web. The vulnerability stems from a lack of...

DEBIAN-CVE-2019-14857

A flaw was found in modauthopenidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in modauthmellon...

iobroker.web Cross-Site Scripting Vulnerability

iobroker.web is a Node.js based web server for reading files from ioBroker DB. A cross-site scripting vulnerability exists in iobroker.web. The vulnerability stems from the WEB application's lack of proper validation of client-side data. An attacker can exploit the vulnerability to execute...

DEBIAN-CVE-2015-2793

Cross-site scripting XSS vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openididentifier parameter in a verify action to ikiwiki.cgi...