Rukovoditel Cross-Site Scripting Vulnerability

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . A cross-site scripting vulnerability exists in the configuration page in Rukovoditel version 2.5.2. The...

CVE-2020-11813

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

Cross site scripting

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

CVE-2020-11813

CVE-2020-11813: In Rukovoditel 2.5.2, a stored XSS exists on the configuration page via the copyright text input, causing injected scripts to potentially steal user data since the copyright text appears on every page. The vulnerability is triggered by unsanitized input in a client-side field; doc...

CVE-2020-8423

A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 firmware version 3.16.9 devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network...

CVE-2020-7249

SMC D3G0804W 3.5.2.5-LATGA devices allow XSS via the SSID field on the WiFi Network Configuration page after a successful login to the admin account...

Design/Logic Flaw

Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page...

Design/Logic Flaw

In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a server configuration page or making an API call...

CVE-2019-14525

The CVE-2019-14525 affects Octopus Deploy versions 2019.4.0–2019.6.x before 2019.6.6 and 2019.7.x before 2019.7.6, where an authenticated system administrator can view sensitive values via a server configuration page or API call. Root cause: insufficient access control on configuration data expos...

Cross site scripting

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server potentially vulnerable to reflected XSS in wireless configuration page...

CVE-2019-6324

HP Color LaserJet Pro M280-M281 Multifunction Printer series (before 20190419) and HP LaserJet Pro MFP M28-M31 Printer series (before 20190426) are affected by a stored XSS in the wireless configuration page due to insufficient input validation on the embedded web server. This could allow an atta...

CVE-2019-6324

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server potentially vulnerable to stored XSS in wireless configuration page...

Cross site scripting

In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configuration utility may result with an improper handling on the JSON response when it is injected by a malicious script via a remote cross-site scripting XSS attack...

qdPM 9.1 - type Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications =========================================================================================== Exploit Title: qdPM 9.1 - 'type' XSS Injection CVE: CVE-2019-8391. Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://qdpm.net Software Link:...

qdPM 9.1 - 'type' Cross-Site Scripting

=========================================================================================== Exploit Title: qdPM 9.1 - 'type' XSS Injection CVE: CVE-2019-8391. Date: 14-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://qdpm.net Software Link:...

CVE-2018-0474

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest credentials in clear text. The vulnerability is due to the incorrect inclusion of saved passwords in configuration pages. An attacker could...

CVE-2018-0665

CVE-2018-0665 affects Yamaha routers RT57i (≤8.00.95), RT58i (≤9.01.51), NVR500 (≤11.00.36), and RTX810 (≤11.01.31). The vulnerability allows an administrative user to embed arbitrary scripts into a configuration form field, which may be executed in another administrative user’s web browser. This...

CVE-2018-0666

CVE-2018-0666 applies to Yamaha devices (RT57i <=8.00.95, RT58i <=9.01.51, NVR500 <=11.00.36, RTX810

Wallabag Application Cross-Site Scripting Vulnerability

Wallabag is a free and open source RSS reader. A cross-site scripting vulnerability exists in the configuration page of the Wallabag application in versions 2.2.3 through 2.3.2, which can be exploited by remote attackers to execute JavaScript code and steal administrator sessions...

CVE-2018-11352

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...