Maccms Cross-Site Scripting Vulnerability (CNVD-2019-17318)

Maccms is a PHP-based content management system CMS for film and television. A cross-site scripting vulnerability exists in Maccms 8.0 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploit this...

Arbitrary File Read Vulnerability in maccms

maccms is a cms website builder. maccms has an arbitrary file reading vulnerability that can be exploited by an attacker to read arbitrary files...

Fortinet FortiManager and Fortinet FortiAnalyzer Cross-Site Scripting Vulnerabilities (CNVD-2019-16608)

Fortinet FortiManager and Fortinet FortiAnalyzer are both products from Fortinet, Inc. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can be grouped into different management domains...

SQL Injection Vulnerability in Tpshop v3.5 Us***.php Page

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the Tpshop v3.5 Us.php page. Attackers can use the vulnerability to obtain sensitive information in the database...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2019-15675)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange OX App Suite 7.8.4 and earlier versions. The vulnerabili...

Moodle Input Validation Error Vulnerability (CNVD-2019-35809)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. An input validation error vulnerability exists in the upload cohorts page in Moodle, which stems from a network system or product that...

Computrols CBAS Web Cross-Site Request Forgery Vulnerability

Computrols CBAS is a building automation system from Computrols USA. A cross-site request forgery vulnerability exists in Computrols CBAS, which can be exploited by an attacker to send unintended requests to a server via an affected client...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2019-16525)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. A cross-site scripting vulnerability in Open-Xchange OX App Suite allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive...

Computrols CBAS Web SQL Injection Vulnerability

CBAS Web is a Web-based building management system BMS from Computrols. A SQL injection vulnerability exists in Computrols CBAS Web. The vulnerability stems from improper validation of parameters passed to different scripts. A remote authenticated attacker could exploit the vulnerability to execu...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field...

Microsoft Edge and ChakraCore Buffer Overflow Vulnerability (CNVD-2019-16206)

Microsoft ChakraCore and Microsoft Edge are both products of Microsoft Corporation.ChakraCore is the core of an open-source Chakra JavaScript scripting engine used in the Edge browser, and is also available as a standalone JavaScript engine. Microsoft Edge is a web browser that comes with Windows...

XSS Vulnerability in JEESNS Administrator Login Screen

JEESNS is an open source social management system developed on the JAVA enterprise level platform. JEESNS administrator login interface has an XSS vulnerability that can be exploited by attackers to inject arbitrary Web script or HTML...

XSS Vulnerability at JEESNS Articles

JEESNS is an open source social management system developed on the JAVA enterprise level platform. JEESNS articles at the existence of XSS vulnerability , an attacker can exploit the vulnerability to inject arbitrary Web script or HTML...

SITO CMS is vulnerable to xss vulnerability

Situ CMS is a self-developed website management system suitable for tourism website construction. An xss vulnerability exists in SITO CMS, which can be exploited by attackers to inject arbitrary web script or HTML...

The vulnerability of the Dr.Web Enterprise Security Suite, an anti-virus protection tool, lies in the lack of restrictions on writing, reading, and creating files within the server folder. This allows attackers to execute arbitrary Lua scripts.

The vulnerability of the Dr.Web Enterprise Security Suite antivirus protection lies in the absence of restrictions on writing, reading, and creating files within the server’s directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary Lua scripts without the need for th...

Code injection

A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller APIC Software could allow an unauthenticated, remote attacker to access sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms for certa...

Arbitrary File Deletion Vulnerability in NiuShop B2B2C Multi-Merchant Mall System Up***.php File

NiuShop B2B2C Multi-Merchant Mall System is a PHP open source e-commerce system designed and developed completely independently by Shanxi NiuKu Information Technology Co. NiuShop B2B2C Multi-merchant Mall System Up.php file exists arbitrary file deletion vulnerability. Attackers can construct...

CVE-2019-11611

doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/download.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information...

CVE-2019-11612

doorGets 7.0 has an arbitrary file deletion vulnerability in /fileman/php/deletefile.php. A remote unauthenticated attacker can exploit this vulnerability to delete arbitrary files...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2019-12704)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 4.6.0 through 4.6.3, which originates from ...