JioFi 4G M2S 1.0.2 - mask Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter. Exploit Author: Vikas Chaudhary Vendor Homepage: https://www.jio.com/ Hardware Link:...

CVE-2018-2880

Vulnerability in the MICROS Retail-J component of Oracle Retail Applications subcomponent: Back Office. The supported version that is affected is 12.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail-J. Successful attacks...

CVE-2019-11376

SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a ?php substring in the second text box. NOTE: the vendor indicates that there was an assumption that the content is "made editable on its own...

CloudBees Jenkins Gearman plugin cross-site request forgery vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Gearman Plugin is used in one of the highly...

CloudBees Jenkins Chef Sinatra Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. company CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks.Chef Sinatra Plugin is used in one of the plugin in...

IBM Rational DOORS Next Generation Cross-Site Scripting Vulnerability (CNVD-2019-09070)

IBM Rational DOORS Next Generation DNG/RRC is a suite of software for capturing, tracking, analyzing, and managing requirements from IBM, USA. The software provides a single platform for global team collaboration to manage requirements more efficiently, sharing unified users, servers and project...

CVE-2019-10276

Western Bridge Cobub Razor 0.8.0 has a file upload vulnerability via the web/assets/swf/uploadify.php URI, as demonstrated by a .php file with the image/jpeg content type...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2019-12161)

CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMSMS versi...

CVE-2018-19917

Microweber 1.0.8 has reflected cross-site scripting XSS vulnerabilities...

Code Execution Vulnerability in EmpireCMS

EmpireCMS is based on B/S structure, secure, stable and flexible website management system. EmpireCMS there are code execution vulnerabilities , attackers can exploit the vulnerability of remote code execution , access to server privileges...

UCMS Cross-Site Scripting Request Vulnerability

UCMS is a simple open source content management system, it can be very easy to quickly develop various kinds of enterprise station, article station and station system. The system is compatible with PHP5.2-PHP7.0, and it can be used on APACHE, NGINX, IIS, and supports two databases of MySQL SQLite...

Google Chrome CSP Bypass Vulnerability (CNVD-2019-23133)

Chrome is a web browsing tool developed by Google. A blob URL CSP bypass vulnerability exists in Google Chrome versions prior to 73.0.3683.75. An attacker can exploit this vulnerability to bypass content security policy via a crafted HTML page...

JTBC Cross-Site Request Forgery Vulnerability

JTBC PHP is a PHP-based open source content management system CMS. A cross-site request forgery vulnerability exists in the /console/account/manage.php?type=action&action=add URL in JTBC v3.0C. A remote attacker can exploit this vulnerability to add an administrator account...

PHPMyWind Cross-Site Scripting Vulnerability

PHPMyWind is a PHP + MySQL based development , W3C standard building engine . A cross-site scripting vulnerability exists in PHPMyWind. The vulnerability is due to the username parameter of /install/index.php in PHPMyWind 5.5 fails to effectively filter user-submitted data, which can be exploited...

CVE-2019-8437

njiandan-cms through 2013-05-23 has index.php/admin/usernew CSRF to add an administrator...

CVE-2019-3776

Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with...

Sparkasse Cross Site Scripting

Document Title: =============== Sparkasse - Multiple Persistent Cross Site Scripting Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2173 Release Date: ============= 2019-03-07 Vulnerability Laboratory ID VL-ID:...

D-Link DIR-878 Empty Password Login Vulnerability

The D-Link DIR-878 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the /HNAP1 URI in the D-Link DIR-878 version 1.12B01. The vulnerability can be exploited by an attacker to log in to the device with the help of an empty password...

CVE-2019-9016

An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formname parameter in a mod=column request, as demonstrated by the...

Multiple Cross-Site Scripting Vulnerabilities in Ericsson Active Library Explorer

Ericsson Active Library Explorer is server-based software that allows users to browse Ericsson document libraries and documents using a standard Web browser. Ericsson Active Library Explorer has multiple cross-site scripting vulnerabilities. Due to the program failing to adequately filter...