5632 matches found
CVE-2017-8139
CVE-2017-8139 affects Huawei HedEx/HedEx Lite prior to V200R006C00. The vulnerability is a stored cross-site scripting (XSS) flaw in the configuration file, enabling an attacker to embed malicious scripts and disrupt legitimate users’ services. Descriptions consistently indicate the issue resides...
CVE-2017-8139
HedEx Earlier than V200R006C00 versions have the stored cross-site scripting XSS vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users...
CVE-2017-8139: Improper Neutralization of Input During Web Page Generation
HedEx Earlier than V200R006C00 versions have the stored cross-site scripting XSS vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users...
Livebox File Upload Vulnerability
Livebox is a multifunctional ADSL modem. This product provides telephony, Internet access and TV playback. A file upload vulnerability exists in Livebox version 1.1. A remote attacker can exploit this vulnerability with specially crafted JavaScript code to upload or download arbitrary configurati...
PT-2017-18148
Name of the Vulnerable Software and Affected Versions HedEx versions prior to V200R006C00 Description The issue allows attackers to exploit a stored cross-site scripting XSS vulnerability, enabling them to plant malicious scripts into the configuration file and interrupt the services of legitimat...
DblTek - Multiple Vulnerabilities
DblTek - Multiple Vulnerabilities Vulnerabilities summary The following advisory describes 2 two vulnerabilities found in DblTek webserver. DBL is “specialized in VoIP products, especially GoIPs. We design, develop, manufacture, and sell our products directly and via distributors to customers. Ou...
DblTek - Multiple Vulnerabilities
Vulnerabilities summary The following advisory describes 2 two vulnerabilities found in DblTek webserver. DBL is “specialized in VoIP products, especially GoIPs. We design, develop, manufacture, and sell our products directly and via distributors to customers. Our GoIP models now cover 1, 4, 8, 1...
CVE-2017-1000125
Codiadfull version is vulnerable to write anything to configure file in the installation resulting upload a webshell...
CVE-2017-1000192: Undefined Security Weakness
Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacker can read the configuration files that contain the login and password from the database, private encryption key, as well as other sensitive information...
PT-2017-10827
Name of the Vulnerable Software and Affected Versions Codiad affected versions not specified Description The issue allows writing to the configuration file during installation, potentially enabling the upload of a webshell. Recommendations At the moment, there is no information about a newer...
CVE-2014-3150: Undefined Security Weakness
Livebox 1.1 allows remote authenticated users to upload arbitrary configuration files, download the configuration file, or obtain sensitive information via crafted Javascript...
CVE-2017-16780
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file...
Design/Logic Flaw
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file...
CVE-2017-16780
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file...
CVE-2017-16780
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file...
CVE-2017-16780
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file...
PYSEC-2017-78
An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from "/.confire.yaml" using the yaml.load function, a YAML parser can execute arbitrary Python commands resulting in command execution. An...
PT-2017-14553
Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.13 Description The issue allows remote attackers to execute arbitrary code by writing to the configuration file. Recommendations For versions prior to 1.8.13, update to version 1.8.13 or later to resolve the issue...
CloudBees Jenkins SSH Plugin Information Disclosure Vulnerability
CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks . SSH Plugin is one of t...
mybb -- multiple vulnerabilities
myBB Team reports: High risk: Installer RCE on configuration file write High risk: Language file headers RCE Medium risk: Installer XSS Medium risk: Mod CP Edit Profile XSS Low risk: Insufficient moderator permission check in delayed moderation tools Low risk: Announcements HTML filter bypass Low...