CVE-2017-1000156: Improper Privilege Management

Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role...

PT-2017-10856

Name of the Vulnerable Software and Affected Versions Mahara versions 15.04 through 15.04.8 Mahara versions 15.10 through 15.10.4 Mahara versions 16.04 through 16.04.2 Description The issue allows a group's configuration page to be edited by any group member, even if they do not have the admin...

NetComm Wireless 4GT101W Router Information Disclosure Vulnerability

NetComm Wireless 4GT101W routers is a wireless router product from NetComm Wireless Australia. A security vulnerability in NetComm Wireless 4GT101W routers running hardware version 0.01/software version V1.1.8.8/bootloader version 1.1.3 stems from the program's failure to perform an authenticatio...

CVE-2017-1370

IBM Jazz Reporting Service JRS 5.0 and 6.0 could disclose sensitive information, including user credentials, through an error message from the Report Builder administrator configuration page. IBM X-Force ID: 126863...

LogRhythm Network Monitor Command Execution Vulnerability

LogRhythm Network Monitor is a real-time monitoring system for network threats. A command execution vulnerability exists in LogRhythm Network Monitor. The vulnerability stems from the "/data/api/configuration/" page not strictly validating the parameters passed, which can be exploited by an...

CVE-2016-5055

CVE-2016-5055 affects OSRAM SYLVANIA Osram Lightify Pro prior to 2016-07-26, with XSS in the username field and the Wireless Client Mode configuration page. NVD data lists CVSS2/3 base scores (4.3/6.1) and NETWORK attack vector; impact includes partial integrity and low confidentiality, with user...

CVE-2016-5055: Improper Neutralization of Input During Web Page Generation

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page...

The vulnerability of the GNU Mailman mailing system allows a hacker to gain access to the authentication data of arbitrary users.

The vulnerability of the GNU Mailman system’s user configuration page relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to remotely access the authentication data of arbitrary users through modified requests. As a result, the access to the...

PT-2015-2429

Name of the Vulnerable Software and Affected Versions SAP HANA DB version 1.00.73.00.389160 Description The issue concerns multiple SQL injection vulnerabilities in the Web-based Development Workbench of SAP HANA DB. These vulnerabilities allow remote authenticated users to execute arbitrary SQL...

CVE-2015-7727: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 NewDB100REL allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors in the 1 trace configuration page or 2 getSqlTraceConfiguration function, aka SAP...

Liferay Portal 6.2 EE SP13 Cross Site Scripting

Hey guys, during a penatrationtest I have found an unknown persistent xss in liferay portal backend. General Information Manufacture description: Liferay Portal is an enterprise-web-platform for the development of business solutions, which provides quick results and long-term values. Details ·...

PT-2015-7517

Name of the Vulnerable Software and Affected Versions Drupal CMS Updater module versions 7.x-1.x before 7.x-1.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page...

CVE-2015-7307: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page...

Sinapsi eSolar Light Plaintext Password Disclosure Vulnerability

Sinapsi eSolar Light is a monitoring system for use within solar applications from the Italian company Sinapsi. A security vulnerability in Sinapsi eSolar Light allows a remote attacker to read the HTML source code in the mail-configuration page to obtain a clear-text password and use it for...

Code injection

Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...

CVE-2015-3949

Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...

CVE-2015-3949: Exposure of Sensitive Information to an Unauthorized Actor

Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...

PT-2015-4061

Name of the Vulnerable Software and Affected Versions FortiWeb versions 5.1.2 through 5.3.4 Description A cross-site scripting XSS issue exists in the autolearn configuration page, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For FortiW...

CVE-2014-8619: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the autolearn configuration page in Fortinet FortiWeb 5.1.2 through 5.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8320: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results configuration page...