7035 matches found
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in epg search result viewer kkcald 0.7.21 and earlier allows an attacker to hijack the authentication of administrators via unspecified vectors...
CVE-2017-1000393
Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agent via execution of command on master'. This allowed them to run arbitrary shell commands on the master node whenever the agent was suppose...
CVE-2017-1000393
CVE-2017-1000393 affects Jenkins 2.73.1 and earlier, and 2.83 and earlier. A misconfigured launch method, “Launch agent via execution of command on master,” allowed users with permission to create/configure agents to execute arbitrary shell commands on the master when launching agents. The underl...
CVE-2018-6313
Cross-site scripting XSS in WBCE CMS 1.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the Modify Page screen, a different issue than CVE-2017-2118...
Cross site scripting
Cross-site scripting XSS in WBCE CMS 1.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the Modify Page screen, a different issue than CVE-2017-2118...
CVE-2018-6313
Cross-site scripting XSS in WBCE CMS 1.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the Modify Page screen, a different issue than CVE-2017-2118...
CVE-2018-6313
Cross-site scripting XSS in WBCE CMS 1.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the Modify Page screen, a different issue than CVE-2017-2118...
CVE-2018-6313
CVE-2018-6313 affects WBCE CMS, version 1.3.1. It is a cross-site scripting (XSS) vulnerability where remote authenticated administrators can inject arbitrary script or HTML via the Modify Page screen (a distinct issue from CVE-2017-2118). The available sources describe the vulnerable component a...
Cross-site Request Forgery (CSRF)
The Jenkins Translation plugin is vulnerable to cross-site request forgery CSRF attacks. POST requests don't require a form submission to be submitted. Leveraging this, attackers can override localized strings displayed to all users when the victim is a Jenkins administrator...
Concrete CMS: Administrators can add other administrators
Because I know you like crayons here's a token of my appreciation... :D F253771 Concrete5 version: 8.3.1 Release date: 12/20/17 Where: Core CMS Vulnerability: Privilege Escalation OTG-AUTHZ-003 Privilege escalation occurs when a user gets to access more resources than is normally allowed when it...
CVE-2017-15627
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-pns variable in the pptpclient.lua file...
CVE-2017-15631
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-workmode variable in the pptpclient.lua file...
CVE-2017-15632
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptpserver.lua file...
CVE-2017-15637
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptpserver.lua file...
CVE-2017-15633
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-ipgroup variable in the sessionlimits.lua file...
CVE-2017-15630
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-remotesubnet variable in the pptpclient.lua file...
CVE-2017-15629
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-tunnelname variable in the pptpclient.lua file...
CVE-2017-15631
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-workmode variable in the pptpclient.lua file...