Joomla! AMGallery Component SQL Injection Vulnerability

Joomla! is a U.S. Open Source Matters team using PHP and MySQL development of a set of open source , cross-platform content management system CMS. AMGallery is used in which a picture display component . A SQL injection vulnerability exists in the AMGallery component of Joomla! An attacker can...

The vulnerability of the web access module of the DIRECTUM electronic document management system allows a perpetrator to execute arbitrary JavaScript code.

The vulnerability of the web access module of the DIRECTUM electronic document management system is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...

PHPSHE Mall System v1.7 Exists Arbitrary File Deletion Vulnerability

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. PHPSHE Mall System v1.7 exists arbitrary file...

CVE-2019-3413

All versions up to V20.18.40.R7.B1of ZTE NetNumen DAP product have an XSS vulnerability. Due to the lack of correct validation of client data in WEB applications, which results in users being hijacked...

UBUNTU-CVE-2019-12387

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

Maccms Cross-Site Scripting Vulnerability (CNVD-2019-17318)

Maccms is a PHP-based content management system CMS for film and television. A cross-site scripting vulnerability exists in Maccms 8.0 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploit this...

Arbitrary File Read Vulnerability in maccms

maccms is a cms website builder. maccms has an arbitrary file reading vulnerability that can be exploited by an attacker to read arbitrary files...

Fortinet FortiManager and Fortinet FortiAnalyzer Cross-Site Scripting Vulnerabilities (CNVD-2019-16608)

Fortinet FortiManager and Fortinet FortiAnalyzer are both products from Fortinet, Inc. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can be grouped into different management domains...

SQL Injection Vulnerability in Tpshop v3.5 Us***.php Page

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the Tpshop v3.5 Us.php page. Attackers can use the vulnerability to obtain sensitive information in the database...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2019-15675)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange OX App Suite 7.8.4 and earlier versions. The vulnerabili...

Moodle Input Validation Error Vulnerability (CNVD-2019-35809)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. An input validation error vulnerability exists in the upload cohorts page in Moodle, which stems from a network system or product that...

Computrols CBAS Web Cross-Site Request Forgery Vulnerability

Computrols CBAS is a building automation system from Computrols USA. A cross-site request forgery vulnerability exists in Computrols CBAS, which can be exploited by an attacker to send unintended requests to a server via an affected client...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2019-16525)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. A cross-site scripting vulnerability in Open-Xchange OX App Suite allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive...

Computrols CBAS Web SQL Injection Vulnerability

CBAS Web is a Web-based building management system BMS from Computrols. A SQL injection vulnerability exists in Computrols CBAS Web. The vulnerability stems from improper validation of parameters passed to different scripts. A remote authenticated attacker could exploit the vulnerability to execu...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field...

Microsoft Edge and ChakraCore Buffer Overflow Vulnerability (CNVD-2019-16206)

Microsoft ChakraCore and Microsoft Edge are both products of Microsoft Corporation.ChakraCore is the core of an open-source Chakra JavaScript scripting engine used in the Edge browser, and is also available as a standalone JavaScript engine. Microsoft Edge is a web browser that comes with Windows...

XSS Vulnerability at JEESNS Articles

JEESNS is an open source social management system developed on the JAVA enterprise level platform. JEESNS articles at the existence of XSS vulnerability , an attacker can exploit the vulnerability to inject arbitrary Web script or HTML...

XSS Vulnerability in JEESNS Administrator Login Screen

JEESNS is an open source social management system developed on the JAVA enterprise level platform. JEESNS administrator login interface has an XSS vulnerability that can be exploited by attackers to inject arbitrary Web script or HTML...

SITO CMS is vulnerable to xss vulnerability

Situ CMS is a self-developed website management system suitable for tourism website construction. An xss vulnerability exists in SITO CMS, which can be exploited by attackers to inject arbitrary web script or HTML...

The vulnerability of the Dr.Web Enterprise Security Suite, an anti-virus protection tool, lies in the lack of restrictions on writing, reading, and creating files within the server folder. This allows attackers to execute arbitrary Lua scripts.

The vulnerability of the Dr.Web Enterprise Security Suite antivirus protection lies in the absence of restrictions on writing, reading, and creating files within the server’s directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary Lua scripts without the need for th...