CVE-2017-7341: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...

UBUNTU-CVE-2017-11183

front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter...

CVE-2017-11715: Improper Control of Generation of Code

job/uploadfilesave.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php...

CVE-2017-11201: Improper Neutralization of Input During Web Page Generation

application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action...

PT-2017-18617 · Cms Made Simple · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.1.6 Description: The issue allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to "admin/editusertag.php", related to the CreateTagFunction and CallUserTag functions. The...

CVE-2017-3888

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability affects...

SA138 : OS Command Injection Vulnerability in ASG and CA

SUMMARY The ASG and CA web-based management consoles are susceptible to an OS command injection vulnerability. An authenticated malicious administrator can execute arbitrary OS commands with elevated system privileges. AFFECTED PRODUCTS Advanced Secure Gateway ASG --- CVE | Affected Releases |...

ZX_CSV Upload 1 – Authenticated SQL Injection

Type user access: admin user. $GET‘id’ is not escaped. URL is accessible for every registered user. 1 – Login with admin user. 2 - Send request post:...

CVE-2016-3144

Cross-site scripting XSS vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name...

CVE-2016-0709

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. dot dot in a ZIP archive entry, as demonstrated by...

cPanel 5-9 Killacct Script Customer Account DNS Information Deletion Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10468/info cPanel is prone to a vulnerability that can allow a remote authenticated administrator to delete customer account DNS information for customers that are not administered by that administrator. This attack can...

CVE-2012-5388: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcmsodevelopername parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-53...

Promise NAS NS4300N GUI bug

List, There is a bug in the Promise NAS NS4300N web GUI firmware version 1.1.0.5 which allows an authenticated admin user to change the password of the 'root' account. The user management portion of the web interface allows the admin user to change user's passwords. The PHP script that handles th...