306 matches found
CVE-2020-13241
CVE-2020-13241 affects Microweber 1.1.18. The issue is an uncontrolled/unrestricted file upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the added file’s extension corresponds to an image file. This can enable upload of non-image files via the Add Image option...
CVE-2020-6586
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...
inedo-buildmaster showed plain text password in configuration form
inedo-buildmaster stores a service password in its global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting...
Information disclosure
BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR-Configuration+Details/Default+Admin+View/, AST%3AARServerConnection/Default+Admin+View/, and AR+System+Administration%3A+Server+Information/Default+Admin+Vie...
GitHub Authentication Plugin showed plain text client secret in configuration form
GitHub Authentication Plugin stores the client secret in the global Jenkins configuration. While the client secret is stored encrypted on disk, it was transmitted in plain text as part of the configuration form and displayed without masking. This could result in exposure of the client secret...
OpenId Connect Authentication Plugin showed plain text client secret in configuration form
OpenId Connect Authentication Plugin stores the client secret in the global Jenkins configuration. While the client secret is stored encrypted on disk, it was transmitted in plain text as part of the configuration form and displayed without masking. This could result in exposure of the client...
Cross site request forgery (csrf)
An issue was discovered in creditease-sec insight through 2018-09-11. loginuserdelete in srcpm/app/admin/views.py allows CSRF...
Sql injection
Bus Booking Script has SQL Injection via the admin/viewseatseller.php spid parameter or the admin/viewmember.php memid parameter...
PT-2017-15034
Name of the Vulnerable Software and Affected Versions Bus Booking Script affected versions not specified Description The issue concerns SQL Injection, which can be exploited via specific parameters in certain PHP files. The vulnerable parameters are sp id in the "admin/view seatseller.php" endpoi...
Sql injection
Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/membersview.php...
Mail.ru: Нежелательная информация
Приветствую. Вариант обхода запрета просмотра админки http://bb.mail.ru/admin через фишку Drupal http://bb.mail.ru/?q=admin/ На мой взгляд, не критично, но можно и пофиксить =...
Fujitsu Web-Based Admin View 2.1.2 - Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/30780/info Fujitsu Web-Based Admin View is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. This issue occurs in the application's HTTP server...
CVE-2013-2715
Cross-site scripting XSS vulnerability in the admin view in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a crafted field name...
PT-2013-3884
Name of the Vulnerable Software and Affected Versions Drupal search api module versions 7.x-1.x before 7.x-1.4 Description A cross-site scripting XSS issue exists in the admin view of the Search API module, allowing remote authenticated users with specific permissions to inject arbitrary web scri...
WordPress Plugin RSVPMaker 2.5.4 - Persistent Cross-Site Scripting
WordPress Plugin RSVPMaker 2.5.4 - Persistent Cross-Site Scripting Exploit Title: WordPress RSVPMaker v2.5.4 Persistent XSS Date: 8/12/12 Exploit Author: Chris Kellum Vendor Homepage: http://rsvpmaker.com/ Software Link: http://downloads.wordpress.org/plugin/rsvpmaker.zip Version: 2.5.4...
CVE-2012-0914
The CVE-2012-0914 issue affects the Drupal Panels module: Panels 6.x-2.x before 6.x-3.10 and 7.x-3.x before 7.x-3.0 allow XSS via Region titles due to insufficient input sanitization. An attacker must have a role with the permission to administer panel layouts and be a remote authenticated user w...
PT-2012-2946
Name of the Vulnerable Software and Affected Versions Panels module versions 6.x-2.x through 6.x-3.9 Panels module versions 7.x-3.x through 7.x-2.x Description A cross-site scripting XSS issue exists in the Panels module, specifically in the display renderers/panels renderer editor.class.php file...
Directory traversal
Directory traversal vulnerability in Fujitsu Web-Based Admin View 2.1.2 allows remote attackers to read arbitrary files via a .. dot dot in the URI...
