Metronet Tag Manager 1.2.7 Cross Site Request Forgery

Details ================ Software: Metronet Tag Manager Version: 1.2.7 Homepage: https://wordpress.org/plugins/metronet-tag-manager/ Advisory report: https://advisories.dxw.com/advisories/csrf-metronet-tag-manager/ CVE: Awaiting assignment CVSS: 5.8 Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N Description...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-09388)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in idreamsoft iCMS version 7.0. A remote attacker can add Column with the help of /admincp.php?app=articlecategory&do=save&frame=iPHP to exploit the...

CVE-2018-8900

The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center ACC for cross-site scripting XSS vulnerability...

CVE-2018-8900

The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center ACC for cross-site scripting XSS vulnerability...

CVE-2018-8900

The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center ACC for cross-site scripting XSS vulnerability...

Cross site scripting

The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center ACC for cross-site scripting XSS vulnerability...

CVE-2018-8900

The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center ACC for cross-site scripting XSS vulnerability...

CVE-2018-8900

CVE-2018-8900 affects Gemalto HASP SRM, Sentinel HASP, and Sentinel LDK licenses. The License Manager service (ACC) is vulnerable to cross-site scripting (XSS) in the logs page. Affected versions are listed variably across sources: CNVD cites 2.10–7.66; NVD notes all versions prior to Sentinel LD...

CVE-2018-10250

iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixincategory action, aka a WeChat Classified Management keyword search...

Cross site request forgery (csrf)

An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request...

Contec Smart Home Authentication Bypass Vulnerability

Contec Smart Home 4.15 devices do not require authentication for newuser.php, edituser.php, deleteuser.php, and user.php, as demonstrated by changing the admin password and then obtaining control over doors. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from ...

Design/Logic Flaw

Contec Smart Home 4.15 devices do not require authentication for newuser.php, edituser.php, deleteuser.php, and user.php, as demonstrated by changing the admin password and then obtaining control over doors...

CVE-2017-11498

Buffer overflow in hasplms in Gemalto ACC Admin Control Center, all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to shut down the remote process a denial of service via a language pack ZIP file with invalid HTML files...

CVE-2017-9378

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks such as data backups to complete before a user is deleted...

CVE-2017-9378

BigTree CMS up to version 4.2.18 allows a user to delete their own account, an action that should be admin-only. The root cause is a missing access-control check on account deletion, enabling self-removal and potential disruption to admin workflows (e.g., data backups). No exploits or in‑the‑wild...

WordPress Plugin Social Share Buttons-Social Pug Cross-Site Scripting

Vulnerability This plugin takes input from $GET and puts it directly into HTML without escaping it. This means that anybody who is able to convince an admin user to click on a link would be able to take control of their browser on that domain name and delete posts, add new admin users, etc.. Proo...

CVE-2016-9421

Cross-site scripting XSS vulnerability in the Users module in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9409

Cross-site scripting XSS vulnerability in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs...

CVE-2016-9413

The Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-9419

Cross-site scripting XSS vulnerability in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...