PT-2017-10856

Name of the Vulnerable Software and Affected Versions Mahara versions 15.04 through 15.04.8 Mahara versions 15.10 through 15.10.4 Mahara versions 16.04 through 16.04.2 Description The issue allows a group's configuration page to be edited by any group member, even if they do not have the admin...

CVE-2017-1000156: Improper Privilege Management

Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role...

NetComm Wireless 4GT101W Router Information Disclosure Vulnerability

NetComm Wireless 4GT101W routers is a wireless router product from NetComm Wireless Australia. A security vulnerability in NetComm Wireless 4GT101W routers running hardware version 0.01/software version V1.1.8.8/bootloader version 1.1.3 stems from the program's failure to perform an authenticatio...

CVE-2017-1370

IBM Jazz Reporting Service JRS 5.0 and 6.0 could disclose sensitive information, including user credentials, through an error message from the Report Builder administrator configuration page. IBM X-Force ID: 126863...

LogRhythm Network Monitor Command Execution Vulnerability

LogRhythm Network Monitor is a real-time monitoring system for network threats. A command execution vulnerability exists in LogRhythm Network Monitor. The vulnerability stems from the "/data/api/configuration/" page not strictly validating the parameters passed, which can be exploited by an...

CVE-2016-5055

CVE-2016-5055 affects OSRAM SYLVANIA Osram Lightify Pro prior to 2016-07-26, with XSS in the username field and the Wireless Client Mode configuration page. NVD data lists CVSS2/3 base scores (4.3/6.1) and NETWORK attack vector; impact includes partial integrity and low confidentiality, with user...

CVE-2016-5055: Improper Neutralization of Input During Web Page Generation

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page...

GNU Mailman Authentication Information Disclosure

The vulnerability of the GNU Mailman system’s user configuration page relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to remotely access the authentication data of arbitrary users through modified requests. As a result, the access to the...

PT-2015-2429

Name of the Vulnerable Software and Affected Versions SAP HANA DB version 1.00.73.00.389160 Description The issue concerns multiple SQL injection vulnerabilities in the Web-based Development Workbench of SAP HANA DB. These vulnerabilities allow remote authenticated users to execute arbitrary SQL...

CVE-2015-7727: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 NewDB100REL allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors in the 1 trace configuration page or 2 getSqlTraceConfiguration function, aka SAP...

Liferay Portal 6.2 EE SP13 Cross Site Scripting

Hey guys, during a penatrationtest I have found an unknown persistent xss in liferay portal backend. General Information Manufacture description: Liferay Portal is an enterprise-web-platform for the development of business solutions, which provides quick results and long-term values. Details ·...

PT-2015-7517

Name of the Vulnerable Software and Affected Versions Drupal CMS Updater module versions 7.x-1.x before 7.x-1.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page...

CVE-2015-7307: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page...

Sinapsi eSolar Light Plaintext Password Disclosure Vulnerability

Sinapsi eSolar Light is a monitoring system for use within solar applications from the Italian company Sinapsi. A security vulnerability in Sinapsi eSolar Light allows a remote attacker to read the HTML source code in the mail-configuration page to obtain a clear-text password and use it for...

Code injection

Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...

CVE-2015-3949

Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...

CVE-2015-3949: Exposure of Sensitive Information to an Unauthorized Actor

Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...

CVE-2014-8619: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the autolearn configuration page in Fortinet FortiWeb 5.1.2 through 5.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-4061

Name of the Vulnerable Software and Affected Versions FortiWeb versions 5.1.2 through 5.3.4 Description A cross-site scripting XSS issue exists in the autolearn configuration page, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For FortiW...

PT-2014-8469

Name of the Vulnerable Software and Affected Versions Drupal Custom Search module versions 6.x-1.x before 6.x-1.12 Drupal Custom Search module versions 7.x-1.x before 7.x-1.14 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with specific permissions to...