UBUNTU-CVE-2020-6516

Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Wing FTP Server 6.3.8 Remote Code Execution

Exploit Title: Wing FTP Server 6.3.8 - Remote Code Execution Authenticated Date: 2020-06-26 Exploit Author: v1n1v131r4 Vendor Homepage: https://www.wftpserver.com/ Software Link: https://www.wftpserver.com/download.htm Version: 6.3.8 Tested on: Windows 10 CVE : -- Wing FTP Server have a web conso...

File Inclusion Vulnerability in HisiPHP

HisiPHP is based on ThinkPHP5 + Layui development of a set of free WEB open source framework. HisiPHP has a file inclusion vulnerability. Attackers can use the vulnerability to obtain server privileges...

Path traversal

In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to...

CVE-2020-6164

In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to...

Stored Cross-Site Scripting Vulnerability at ZZCMS Profile

ZZCMS is a free website builder developed in asp language. A stored cross-site scripting vulnerability exists at the ZZCMS profile. An attacker can exploit the vulnerability to obtain sensitive information such as user cookies...

Arbitrary File Deletion Vulnerability in MCMS

MCMS is a website building system of MINGFEI TECHNOLOGY CO. MCMS suffers from an arbitrary file deletion vulnerability. An attacker can exploit this vulnerability to delete arbitrary files from the server...

NeDi Consulting NeDi Cross-Site Scripting Vulnerability (CNVD-2020-44575)

NeDi Consulting NeDi is a suite of open source software that supports discovery and mapping of network devices from the Swiss company NeDi Consulting. A cross-site scripting vulnerability exists in NeDi Consulting NeDi version 1.9C. The vulnerability can be exploited to execute arbitrary JavaScri...

CVE-2020-15034

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Setup.php tet parameter...

CVE-2020-15036

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Linked.php dv parameter...

PrestaShop cross-site scripting vulnerability (CNVD-2020-36217)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A cross-site scripting vulnerability exists in PrestaShop. The vulnerability stems fr...

Atlassian JIRA Server and Data Center Authorization Issues Vulnerability

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

Nozomi Networks Guardian Cross-Site Scripting Vulnerability

Nozomi Networks Guardian is an IoT device and software inspection system from Nozomi Networks, Switzerland. A cross-site scripting vulnerability exists in Nozomi Networks Guardian versions prior to 19.0.4. The vulnerability stems from the lack of proper validation of client data by the WEB...

Perfex v2.4.4 CRM - (Print) Persistent Web Vulnerability

Document Title: =============== Perfex v2.4.4 CRM - Print Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2231 Release Date: ============= 2020-06-23 Vulnerability Laboratory ID VL-ID: ==================================== 22...

CVE-2020-13480

Verint Workforce Optimization WFO 15.2 allows HTML injection via the "send email" feature...

grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL

An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer...

undertow: invalid HTTP request with large chunk size

A flaw was found in Undertow, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling...

SAP Fiori Input Validation Error Vulnerability

SAP Fiori, a user experience UX design system for SAP applications from SAP, Germany, provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, delivering a consistent, innovative experience for creators and users. An input validation...

74cms Arbitrary File Deletion Vulnerability

74cms is a free and open source professional recruitment system based on PHP+MYSQL as the core development. 74cms arbitrary file deletion vulnerability , an attacker can use the vulnerability to delete any file...

Stored Cross-Site Scripting Vulnerability in YzmCMS

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture, YzmCMS can run on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMS has a stored cross-site scripting vulnerability. An attacker can exploit the vulnerability to obtain an administrator cookie...