Archive
19 March 2020
Vulnerabilities first published on this day (UTC), newest first.
78 results · Feed
-
Unscored —
Enigma NMS 65.0.0 and prior allows administrative users to create low-privileged accounts that do not have the ability …
-
Unscored —
An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allow…
-
High 7.5
phpBB arbitrary CSS injection
phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.
-
Unscored —
A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior tha…
-
Unscored —CVE-2019-16068 Public exploit
A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to tr…
-
Unscored —
An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki. Oversighted edit summaries are still v…
-
Unscored —
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on th…
-
Unscored —
NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages. It is possible for an att…
-
Unscored —
Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. Successful exploitation…
-
Medium 6.1
MantisBT XSS when uploading an attachment
The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. T…
-
Unscored —
The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system…
-
Unscored —
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parame…
-
Unscored —
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp.…
-
Unscored —
In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This aff…
-
Unscored —
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateMana…
-
Unscored —
A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior tha…
-
Medium 6.1
Ignite Realtime Openfire allows Cross-site Scripting
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.
-
Unscored —
NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web appl…
-
Medium 6.1
Ignite Realtime Openfire allows Cross-site Scripting
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.
-
Unscored —
An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 a…
-
Unscored —CVE-2019-16065 Public exploit
A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows …
-
Unscored —
NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated use…
-
Unscored —
NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database. It is possible for a…
-
High 7.4
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.
-
High 7.4
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.
-
High 7.4
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.
-
High 7.4
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.
-
Unscored —
A number of files on the NETSAS Enigma NMS server 65.0.0 and prior are granted weak world-readable and world-writable p…
-
High 7.4
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.
-
High 7.4
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.
-
High 7.4
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.
-
High 7.4
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.
-
Unscored —
Open edX Ironwood.1 allows support/certificates?user= reflected XSS.
-
Unscored —
In ONAP OOM through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, an…
-
Unscored —
In ONAP DCAE through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, a…
-
Unscored —
In ONAP Logging through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285…
-
Medium 4.0CVE-2020-5267 Public exploit
Possible XSS vulnerability in ActionView
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions…
-
Unscored —
D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted reque…
-
Unscored —
D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to…
-
Unscored —
Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?downloa…