CVE-2018-10250

iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixincategory action, aka a WeChat Classified Management keyword search...

CVE-2018-10250

iCMS v7.0.8 contains a Cross-Site Scripting (XSS) vulnerability in the weixin_category action, exploited via the admincp.php keywords parameter. The issue arises from insufficient sanitization of the keywords input, enabling injection of arbitrary script/HTML when interacting with the WeChat Clas...

CVE-2017-10250

CVE-2017-10250 affects Oracle PeopleSoft Enterprise PeopleTools (subcomponent: Tuxedo). Affected versions are 8.54 and 8.55. The vulnerability is exploitable by a low-privilege attacker who can log on to the infrastructure where PeopleSoft Enterprise PeopleTools runs, potentially leading to unaut...

CVE-2016-10250

The jp2colrdestroy function in jp2cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service NULL pointer dereference by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887...

CVE-2016-10250

The vulnerability CVE-2016-10250 affects JasPer’s JP2 box handling. Specifically, the jp2_colr_destroy function in jp2_cod.c (JasPer) before 1.900.13 allows a remote attacker to cause a denial of service via a NULL pointer dereference due to incomplete cleanup of JP2 box data on error (note: tied...

CVE-2016-10250

The jp2colrdestroy function in jp2cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service NULL pointer dereference by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887...

UBUNTU-CVE-2016-10250

The jp2colrdestroy function in jp2cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service NULL pointer dereference by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887...

CVE-2015-2959

Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role...

CVE-2015-4418

CVE-2015-4418 affects Zoho NetFlow Analyzer builds 10250 and earlier. The vulnerability stems from the password field not setting autocomplete to off, enabling potential unauthorized access when an unattended workstation is used. The connected sources (NVD/NVD-like records) corroborate this descr...

CVE-2015-2961

Cross-site request forgery CSRF vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators...

NetFlow Analyzer vulnerable to cross-site request forgery

Overview NetFlow Analyzer provided by Zoho Corporation contains a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged in, various administrative functions may be performed. Solution Update the software build and apply the patch Update the software to bui...

NetFlow Analyzer fails to restrict access permissions

Overview NetFlow Analyzer provided by Zoho Corporation fails to restrict access permissions. Tomoshige Hasegawa, Akihito Mukai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Administrative operations, for...

NetFlow Analyzer vulnerable to cross-site scripting

Overview NetFlow Analyzer provided by Zoho Corporation contains a cross-site scripting vulnerability. Tomoshige Hasegawa, Akihito Mukai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may...

JVN#98447310: NetFlow Analyzer vulnerable to cross-site scripting

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software build and apply the patch Update the software to build 10250...

JVN#79284156: NetFlow Analyzer vulnerable to cross-site request forgery

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer contains a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged in, various administrative functions may be performed. Solution Update the software build and apply...

JVN#25598413: NetFlow Analyzer fails to restrict access permissions

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer fails to restrict access permissions. Impact Administrative operations, for example, changing passwords or user account deletion may be performed by a user with guest privileges. In addition, information...

ManageEngine NetFlow Analyzer Multiple Path Traversal and File Access

ManageEngine NetFlow Analyzer prior to version 10 build 10250 is affected by the following directory traversal vulnerabilities : - User input to the 'schFilePath' parameter to CVSServlet or CReportPDFServlet is not properly sanitized. A remote attacker, using a specially crafted request, can...

Fedora Update for w3m FEDORA-2010-10250

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...