qdPM 9.1 - 'type' Cross-Site Scripting

=========================================================================================== Exploit Title: qdPM 9.1 - 'type' XSS Injection CVE: CVE-2019-8391. Date: 14-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://qdpm.net Software Link:...

CVE-2019-6242: Insufficiently Protected Credentials

Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time...

CVE-2018-0474

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest credentials in clear text. The vulnerability is due to the incorrect inclusion of saved passwords in configuration pages. An attacker could...

CVE-2018-0665

CVE-2018-0665 affects Yamaha routers RT57i (≤8.00.95), RT58i (≤9.01.51), NVR500 (≤11.00.36), and RTX810 (≤11.01.31). The vulnerability allows an administrative user to embed arbitrary scripts into a configuration form field, which may be executed in another administrative user’s web browser. This...

CVE-2018-0666

CVE-2018-0666 applies to Yamaha devices (RT57i <=8.00.95, RT58i <=9.01.51, NVR500 <=11.00.36, RTX810

Wallabag Application Cross-Site Scripting Vulnerability

Wallabag is a free and open source RSS reader. A cross-site scripting vulnerability exists in the configuration page of the Wallabag application in versions 2.2.3 through 2.3.2, which can be exploited by remote attackers to execute JavaScript code and steal administrator sessions...

Cross site scripting

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...

CVE-2018-11352

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...

CVE-2018-11352

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...

CVE-2018-11352: Improper Neutralization of Input During Web Page Generation

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...

PT-2018-10511

Name of the Vulnerable Software and Affected Versions Wallabag application versions 2.2.3 through 2.3.2 Description The issue is related to a cross-site scripting XSS vulnerability stored within the configuration page, which enables the execution of a JavaScript payload each time an administrator...

CVE-2018-10763

Multiple cross-site scripting XSS vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the 1 Main heading or 2 Sub heading fields in the Partial Branding configuration page...

CVE-2018-10763: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the 1 Main heading or 2 Sub heading fields in the Partial Branding configuration page...

PT-2018-10092

Name of the Vulnerable Software and Affected Versions Synametrics SynaMan version 4.0 build 1488 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities can be exploited via the Main heading or Sub heading fields in the Partial Branding configuratio...

CVE-2018-16776

CVE-2018-16776 affects wityCMS 0.6.2 with a reflected XSS via the Site Name field on the Contact Configuration page. The connected documents confirm the vulnerability but do not provide exploitation details, specific root cause analysis, affected versions beyond 0.6.2, or remediation steps. No in...

PT-2018-13740

Name of the Vulnerable Software and Affected Versions wityCMS version 0.6.2 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs via the Site Name field, which is located in the Contact section of the Configuration page. Recommendations For wityCMS version 0.6.2, upda...

CVE-2018-12431

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

CVE-2018-1187: Improper Neutralization of Input During Web Page Generation

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6 is affected by a cross-site scripting vulnerability in the Network Configuration page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or...

MikroTik RouterOS Detection (HTTP)

HTTP based detection of MikroTik RouterOS. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2017-1000156

Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role...