3943 matches found
Dolibarr ERP/CRM Cross-Site Scripting Vulnerability (CNVD-2019-26398)
Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site scripting vulnerability exists in Dolibarr ERP/CR...
The vulnerability in the lxml.html.clean module’s lxml/html/clean.py file allows a attacker to execute cross-site scripting attacks.
The vulnerability in the lxml.html.clean module’s lxml/html/clean.py file relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
SunHater KCFinder Cross-Site Scripting Vulnerability
SunHater KCFinder is an open source file manager. A cross-site scripting vulnerability exists in SunHater KCFinder. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...
EspoCRM cross-site scripting vulnerability (CNVD-2019-24798)
EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM versions prior to 5.6.6. The vulnerability stems from the WEB application...
XML Entity Injection Vulnerability in PageOffice of Beijing Zhuozheng Zhiyuan Software Co.
PageOffice is a solution & product of Zhuozheng Software to solve office online office. PageOffice of Beijing Zhuozheng Zhiyuan Software Co., Ltd. exists XML entity injection vulnerability. The vulnerability arises from the program fails to adequately validate the XML document received from an...
CVE-2019-1010113
Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting XSS. The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a lin...
e107 cross-site scripting vulnerability (CNVD-2019-23526)
e107 is an open source, free and PHP and MySQL based Content Management System CMS from the e107 team. The system supports a wide range of plug-ins and look-alike themes, and can be used as a personal blog, discussion community, archive repository and so on. A cross-site scripting vulnerability...
Trape Cross-Site Scripting Vulnerability (CNVD-2019-22229)
Trape is a suite of open source Internet tracking and identification tools. The tool is capable of remotely identifying sessions and simulating phishing attacks. A cross-site scripting vulnerability exists in the static/js/trape.js file in Trape 2019-05-08 and earlier versions. The vulnerability...
MailEnable Enterprise Premium Cross-Site Request Forgery Vulnerability
MailEnable Enterprise Premium is a suite of POP3 and SMTP mail servers from MailEnable Australia. A cross-site request forgery vulnerability exists in MailEnable Enterprise Premium version 10.23. The vulnerability stems from a WEB application that does not adequately validate that a request is...
MiniCMS Cross-Site Scripting Vulnerability (CNVD-2019-23978)
MiniCMS is a content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in the mc-admin/conf.php file in MiniCMS version 1.10. The vulnerability stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploi...
CVE-2019-13374
A cross-site scripting XSS vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter...
articlestwo.appspot.com Cross Site Scripting vulnerability
Security Researcher calv1n Helped patch 22043 vulnerabilities Received 12 Coordinated Disclosure badges Received 37 recommendations , a holder of 12 badges for responsible and coordinated disclosure, found a security vulnerability affecting articlestwo.appspot.com website and its users. Following...
Pulse Secure Pulse Connect Secure Cross-Site Scripting Vulnerability (CNVD-2019-21083)
Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure in the United States. A cross-site scripting vulnerability exists in the welcome.cgi file in Pulse Secure PCS versions 8.1.x before 8.1R12, 8.2.x before 8.2R9, and...
Arastta eCommerce Cross-Site Scripting Vulnerability
Arastta eCommerce is an open source eCommerce platform. A cross-site scripting vulnerability exists in Arastta eCommerce version 1.6.2. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute...
Joomla! AMGallery Component SQL Injection Vulnerability
Joomla! is a U.S. Open Source Matters team using PHP and MySQL development of a set of open source , cross-platform content management system CMS. AMGallery is used in which a picture display component . A SQL injection vulnerability exists in the AMGallery component of Joomla! An attacker can...
The vulnerability of the web access module of the DIRECTUM electronic document management system allows a perpetrator to execute arbitrary JavaScript code.
The vulnerability of the web access module of the DIRECTUM electronic document management system is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...
PHPSHE Mall System v1.7 Exists Arbitrary File Deletion Vulnerability
PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. PHPSHE Mall System v1.7 exists arbitrary file...
RapidScan - The Multi-Tool Web Vulnerability Scanner
Evolution: It is quite a fuss for a pentester to perform binge-tool-scanning running security scanning tools one after the other sans automation. Unless you are a pro at automating stuff, it is a herculean task to perform binge-scan for each and every engagement. The ultimate goal of this program...
CVE-2019-3413
All versions up to V20.18.40.R7.B1of ZTE NetNumen DAP product have an XSS vulnerability. Due to the lack of correct validation of client data in WEB applications, which results in users being hijacked...