132 matches found
CVE-2019-11428: Improper Neutralization of Input During Web Page Generation
I, Librarian 4.10 has XSS via the export.php exportfiles parameter...
PT-2019-12307
Name of the Vulnerable Software and Affected Versions I, Librarian version 4.10 Description The issue is related to a security problem where an attacker can execute malicious scripts. This is achieved through the export files parameter in the "export.php" API endpoint. Recommendations For I,...
PT-2020-9417
Name of the Vulnerable Software and Affected Versions: iTop versions prior to 2.6.1 Description: The issue is related to a lack of sanitization around error messages, leading to multiple Reflective XSS issues. These issues exist in various PHP files, including webservices/export.php,...
CVE-2019-9960: Improper Limitation of a Pathname to a Restricted Directory
The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path...
PT-2019-2664
Name of the Vulnerable Software and Affected Versions U.motion Builder version 1.3.4 Description A SQL Injection issue exists in the software, which could cause unwanted code execution when an improper set of characters is entered. The vulnerability is related to incorrect handling of special...
UBUNTU-CVE-2019-7334
Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in the view export export.php because proper filtration is omitted...
CVE-2019-7334
Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in the view export export.php because proper filtration is omitted...
CVE-2019-7334
Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in the view export export.php because proper filtration is omitted...
PT-2019-18539
Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Reflected Cross Site Scripting issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable Exportfile parameter value in the "view export" functionality, specifically...
CVE-2019-7334: Improper Neutralization of Input During Web Page Generation
Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in the view export export.php because proper filtration is omitted...
CVE-2019-7387: Improper Limitation of a Pathname to a Restricted Directory
A local file inclusion vulnerability exists in the web interface of Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1TRUNK-20180914.bin devices. When the export function is called from system/maintenance/export.php, it accepts the path provided by the user, leading to path traversal via...
PT-2019-18572
Name of the Vulnerable Software and Affected Versions Systrome Cumilon devices versions 1.1-R2.1 TRUNK-20180914.bin Description A local file inclusion issue exists in the web interface. The export function, accessible from system/maintenance/export.php, allows path traversal via the name paramete...
Cross-Site Scripting (XSS)
dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The datatoexport parameter in /exports/export.php is not properly sanitized, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the...
CVE-2018-19799
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS...
Cross site scripting
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS...
CVE-2018-19799
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS...
CVE-2018-19799
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS...
CVE-2018-19799: Improper Neutralization of Input During Web Page Generation
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS...
PT-2018-15100
Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM versions 8.0.3 and earlier Description The issue concerns a XSS vulnerability. It affects the "/exports/export.php" endpoint, specifically the datatoexport parameter. Recommendations For versions 8.0.3 and earlier, as a...
Design/Logic Flaw
Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channelname parameter to /index.php?/manage/channel/addchannel or a direct request to /export.php...