BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such, an attacker can input a crafted payload that will execute upon the application's administrator browsing the registered users' list. Once the...
CVE-2020-35677PUBLISHED: 2020-12-24BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in order to create the paylo...
CVE-2020-35669PUBLISHED: 2020-12-24An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.
CVE-2020-2499PUBLISHED: 2020-12-24A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later.
CVE-2020-2503PUBLISHED: 2020-12-24If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File ..
Support the originator by clicking the read the rest link below.
