13515 matches found
CVE-2019-17105
The token generator in index.php in Centreon Web before 2.8.27 is predictable...
CVE-2019-17105
The token generator in index.php in Centreon Web before 2.8.27 is predictable...
PT-2019-14945
Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.27 Description The issue concerns a predictable token generator in the index.php file. This predictability could potentially be exploited. Recommendations For versions prior to 2.8.27, update to version 2.8.2...
CVE-2019-17105: Use of Insufficiently Random Values
The token generator in index.php in Centreon Web before 2.8.27 is predictable...
Remote code execution
Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page...
CVE-2019-17046
CVE-2019-17046 affects Ilch 2.1.22. The vulnerability arises because PHP is listed under “Allowed files” on the index.php/admin/media/settings/index page, enabling remote code execution. The issue is documented across multiple feeds (NVD, Red Hat, CNVD, osv.dev, CVE listings) as a remote code exe...
CVE-2019-17046: Unrestricted Upload of File with Dangerous Type
Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page...
CVE-2015-9444: Improper Neutralization of Input During Web Page Generation
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATHSELF...
PT-2019-7403
Name of the Vulnerable Software and Affected Versions altos-connect plugin version 1.3.0 Description The issue concerns a cross-site scripting XSS problem. It affects the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php "PATH SELF" in the altos-connect plugin...
CVE-2019-16867
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...
CVE-2019-16867
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...
CVE-2019-16867
HongCMS 3.0.0 is affected by a path-traversal vulnerability allowing arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete (and similar CVE-2018-16774 path). Root cause is insufficient validation of the file path, enabling deletion of critical file...
PT-2019-14838
Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file deletion by utilizing a ../ in the file parameter to the "admin/index.php/database/ajax" endpoint with the action set to delete. This can be exploited to delete critical fil...
CVE-2019-16867: Improper Limitation of a Pathname to a Restricted Directory
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...
PT-2019-14793
Name of the Vulnerable Software and Affected Versions NoneCMS version 1.3 Description The issue concerns a CSRF flaw in the public/index.php/admin/admin/dele.html endpoint, which can be exploited to delete the admin user. Recommendations For NoneCMS version 1.3, as a temporary workaround, conside...
PT-2019-14791
Name of the Vulnerable Software and Affected Versions WTCMS version 1.0 Description The issue allows for a CSRF attack with resultant XSS via the index.php endpoint, specifically when accessing the g=admin&m=index&a=index parameters. This can lead to unauthorized actions being performed on the...
CVE-2019-16721: Cross-Site Request Forgery (CSRF)
NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user...
CVE-2019-16719: Improper Neutralization of Input During Web Page Generation
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS...