839 matches found
CVE-2020-24146
CVE-2020-24146 affects the WordPress plugin CM Download Manager (cm-download-manager) up to version 2.7.0. A directory traversal vulnerability is triggered via the fileName parameter in the deletescreenshot action, allowing authorized users to delete arbitrary files and potentially cause a denial...
CVE-2020-24146
Directory traversal in the CM Download Manager aka cm-download-manager plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action...
CVE-2020-24145
CVE-2020-24145 affects the WordPress CM Download Manager (cm-download-manager) plugin, version 2.7.0, via an XSS vulnerability exploitable through a crafted deletescreenshot action. The issue is confirmed across multiple sources (NVD/Red Hat/CNVD, WPVulnDB). Impact is XSS with potential script/HT...
CVE-2020-24145
Cross Site Scripting XSS vulnerability in the CM Download Manager aka cm-download-manager plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot action...
CVE-2020-24145: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in the CM Download Manager aka cm-download-manager plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot action...
CVE-2020-24146: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal in the CM Download Manager aka cm-download-manager plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action...
WordPress 路径遍历漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An authorization issue vulnerability exists in WordPress Plugin CM Download Manager, which can be...
CVE-2021-1478 Cisco Unified Communications Manager Denial of Service Vulnerability
A vulnerability in the Java Management Extensions JMX component of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to cause a denial of service DoS condition on an...
CVE-2021-1478
CVE-2021-1478 affects Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). The issue arises from an unsecured JMX TCP/IP port, permitting an authenticated, remote attacker over the network to restart the JMX process and cause a denial-of-se...
CM Download Manager < 2.8.0 - Authenticated Arbitrary File Deletion
The plugin may allow authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action...
CM Download Manager < 2.8.0 - Unauthenticated Reflected Cross Site Scripting (XSS)
The plugin is vulnerable to Unauthenticated Cross Site Scripting XSS before version 2.8.0...
CVE-2021-1409
Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager Unified CM, Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P, Cisco Unified Communications Manager Session Management Edition Unified CM SME, and Cisco Unity Connection...
CVE-2021-1406
Cisco UC Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME) have an information disclosure vulnerability where downloadable files may inappropriately contain sensitive data. An authenticated attacker with elevated privileges can exploit via a targeted command sequence...
CVE-2021-1406
A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion...
CVE-2021-1355
Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisc...
Path traversal
Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisc...
CVE-2021-1357
CVE-2021-1357 concerns multiple input-validation weaknesses in Cisco Unified Communications Manager IM&P, with a broader impact affecting Unified CM and Unified CM SME. The advisory describes path-traversal and SQL injection vulnerabilities in Unified CM IM&P, which may allow an attacker to acces...
CVE-2021-1357 Cisco Unified Communications Products Vulnerabilities
Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisc...
premier6.cm Cross Site Scripting vulnerability OBB-1492908
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-27121: Uncaught Exception
A vulnerability in Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P Software could allow an authenticated, remote attacker to cause the Cisco XCP Authentication Service on an affected device to restart, resulting in a denial of service DoS condition. The vulnerability is...