PT-2019-13499

Name of the Vulnerable Software and Affected Versions antSword versions prior to 2.1.0 Description The issue is related to self-XSS in the database configuration, which can lead to code execution. This is possible via files such as modules/database/asp/index.js, modules/database/custom/index.js,...

CVE-2019-11232

EXCELLENT INFOTEK BiYan v1.57 v2.8 allows an attacker to leak user information Password without being authenticated, by sending an EMPNO element to the kwslogin/asp/queryuser.asp URI, and then reading the PWD element...

CVE-2019-11232: Improper Authentication

EXCELLENT INFOTEK BiYan v1.57 v2.8 allows an attacker to leak user information Password without being authenticated, by sending an EMPNO element to the kwslogin/asp/queryuser.asp URI, and then reading the PWD element...

CVE-2019-11233: Exposure of Sensitive Information to an Unauthorized Actor

EXCELLENT INFOTEK BiYan v1.57 v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGINID element to the auth/main/asp/checkuserlogininfo.aspx URI, and then reading the response, as demonstrated by the KWEMAIL or KWTEL field...

PT-2019-12207

Name of the Vulnerable Software and Affected Versions EXCELLENT INFOTEK BiYan versions 1.57 through 2.8 Description The issue allows an attacker to leak user information without authentication by sending a LOGIN ID element to the "auth/main/asp/check user login info.aspx" API endpoint and then...

CVE-2018-19612

The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code...

Code injection

The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code...

CVE-2018-19612

The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code...

PT-2019-9876

Name of the Vulnerable Software and Affected Versions Westermo DR-250 versions Pre-5162 Westermo DR-260 versions Pre-5162 Description The issue concerns the /uploadfile functionality, which allows remote users to upload malicious file types and execute ASP code. Recommendations For Westermo DR-25...

Westermo DR-260, DR-250 and MR-260 Code Issue Vulnerabilities

Westermo DR-260 and others are products of the Swedish company Westermo.Westermo DR-260 is a DSL router.Westermo DR-250 is a DSL router.Westermo MR-260 is a 3G multimedia router.Westermo MR-260 is a 3G multimedia router.Westermo MR-260 is a 3G multimedia router.Westermo MR-260 is a 3G multimedia...

CVE-2018-19612: Unrestricted Upload of File with Dangerous Type

The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code...

dotnet: infinite loop in Uri.TryCreate leading to ASP.Net Core Denial of Service

A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981...

dotnet: infinite loop in Uri.TryCreate leading to ASP.Net Core Denial of Service

A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981...

CVE-2017-18372

The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user. The vulnerability is in the toolstime.asp page and can be exploited through the...

SiteServer CMS Arbitrary Code Execution Vulnerability

SiteServer CMS is an open source, free, enterprise-class CMS content management system. An arbitrary code execution vulnerability exists in SiteServer CMS 6.9.0. The vulnerability stems from the fact that administrators can add a permitted file extension .aassp, which is converted to .asp due to...

CVE-2019-11401

A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted...

PT-2019-12286

Name of the Vulnerable Software and Affected Versions SiteServer CMS versions 6.9.0 through 6.11 Description A issue was discovered in SiteServer CMS that allows remote attackers to execute arbitrary code. This is possible because an administrator can add the permitted file extension .aassp, whic...

SQL injection vulnerability in the ch***.asp file of the enterprise website management system of Dynamic Science (CNVD-2019-13589)

Dynamic enterprise website management system is an asp + access for the development of enterprise website source code. There is a SQL injection vulnerability in the ch.asp file. An attacker can exploit the vulnerability to obtain sensitive information from the database...

The vulnerability of the ASP.NET Core software platform, related to errors in handling web requests, allows attackers to cause service failures.

The vulnerability of the ASP.NET Core software platform is related to errors in handling web requests. Exploiting this vulnerability can allow an attacker to cause service interruptions through specially crafted web requests...

Microsoft Windows Multiple Vulnerabilities (KB4493472)

This host is missing a critical security update according to Microsoft KB4493472 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...