Magento cross-site scripting vulnerability (CNVD-2019-25989)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engine and payment gateway and other functions. A cross-site scripting vulnerability exists in Magento version 2.1.18 before version 2.1, 2.2.9 before version 2.2...

cPanel Input Validation Error Vulnerability (CNVD-2019-26365)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An input validation error vulnerability exists in versions of cPanel prior to 78.0.2. The vulnerability stems from a web-based...

PT-2019-2899 · Icedtea +4 · Icedtea-Web +4

Name of the Vulnerable Software and Affected Versions: icedtea-web versions 1.7.2 and earlier icedtea-web versions 1.8.2 and earlier Description: The issue is related to a zip-slip attack during auto-extraction of a JAR file, which could allow an attacker to write files to arbitrary locations. Th...

PT-2019-2938 · Icedtea +4 · Icedtea-Web +4

Name of the Vulnerable Software and Affected Versions: icedtea-web versions 1.7.2 and earlier icedtea-web versions 1.8.2 and earlier Description: The issue is related to insufficient authentication of data, allowing an attacker to inject executable code into a JAR file without compromising...

cPanel Formatting String Error Vulnerability (CNVD-2019-33888)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A formatting string error vulnerability exists in cPanel, no details of the vulnerability are available at this time...

CVE-2019-5457

Cross-site scripting XSS vulnerability in min-http-server all versions allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser...

Dolibarr ERP/CRM Cross-Site Scripting Vulnerability (CNVD-2019-26398)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site scripting vulnerability exists in Dolibarr ERP/CR...

The vulnerability in the lxml.html.clean module’s lxml/html/clean.py file allows a attacker to execute cross-site scripting attacks.

The vulnerability in the lxml.html.clean module’s lxml/html/clean.py file relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

SunHater KCFinder Cross-Site Scripting Vulnerability

SunHater KCFinder is an open source file manager. A cross-site scripting vulnerability exists in SunHater KCFinder. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

EspoCRM cross-site scripting vulnerability (CNVD-2019-24798)

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM versions prior to 5.6.6. The vulnerability stems from the WEB application...

XML Entity Injection Vulnerability in PageOffice of Beijing Zhuozheng Zhiyuan Software Co.

PageOffice is a solution & product of Zhuozheng Software to solve office online office. PageOffice of Beijing Zhuozheng Zhiyuan Software Co., Ltd. exists XML entity injection vulnerability. The vulnerability arises from the program fails to adequately validate the XML document received from an...

CVE-2019-1010113

Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting XSS. The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a lin...

e107 cross-site scripting vulnerability (CNVD-2019-23526)

e107 is an open source, free and PHP and MySQL based Content Management System CMS from the e107 team. The system supports a wide range of plug-ins and look-alike themes, and can be used as a personal blog, discussion community, archive repository and so on. A cross-site scripting vulnerability...

Trape Cross-Site Scripting Vulnerability (CNVD-2019-22229)

Trape is a suite of open source Internet tracking and identification tools. The tool is capable of remotely identifying sessions and simulating phishing attacks. A cross-site scripting vulnerability exists in the static/js/trape.js file in Trape 2019-05-08 and earlier versions. The vulnerability...

MailEnable Enterprise Premium Cross-Site Request Forgery Vulnerability

MailEnable Enterprise Premium is a suite of POP3 and SMTP mail servers from MailEnable Australia. A cross-site request forgery vulnerability exists in MailEnable Enterprise Premium version 10.23. The vulnerability stems from a WEB application that does not adequately validate that a request is...

MiniCMS Cross-Site Scripting Vulnerability (CNVD-2019-23978)

MiniCMS is a content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in the mc-admin/conf.php file in MiniCMS version 1.10. The vulnerability stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploi...

CVE-2019-13374

A cross-site scripting XSS vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter...

articlestwo.appspot.com Cross Site Scripting vulnerability

Security Researcher calv1n Helped patch 22043 vulnerabilities Received 12 Coordinated Disclosure badges Received 37 recommendations , a holder of 12 badges for responsible and coordinated disclosure, found a security vulnerability affecting articlestwo.appspot.com website and its users. Following...

Pulse Secure Pulse Connect Secure Cross-Site Scripting Vulnerability (CNVD-2019-21083)

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure in the United States. A cross-site scripting vulnerability exists in the welcome.cgi file in Pulse Secure PCS versions 8.1.x before 8.1R12, 8.2.x before 8.2R9, and...

Arastta eCommerce Cross-Site Scripting Vulnerability

Arastta eCommerce is an open source eCommerce platform. A cross-site scripting vulnerability exists in Arastta eCommerce version 1.6.2. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute...