CVE-2018-13293

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...

CVE-2019-5890

Affected software: OverIT Geocall 6.3 (before build 2:346977). Vulnerability: Weak authentication and session management allow an authenticated user to access the Administrative control panel and execute administrative functions. Root cause (as described): Improper session handling enabling eleva...

CVE-2019-5890

An issue was discovered in OverIT Geocall 6.3 before build 2:346977. Weak authentication and session management allows an authenticated user to obtain access to the Administrative control panel and execute administrative functions...

CVE-2018-13293

CVE-2018-13293 affects Synology DiskStation Manager (DSM) Control Panel SSO Settings prior to 6.2.1-23824. The vulnerability is a cross-site scripting (XSS) flaw that allows remote authenticated users to inject arbitrary web script or HTML via a URL parameter. Evidence across multiple sources con...

CVE-2018-13293

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...

PT-2019-8958 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.1-23824 Description: A cross-site scripting XSS issue exists in the Control Panel SSO Settings of Synology DiskStation Manager DSM, allowing remote authenticated users to inject arbitrary...

Security Bulletin: Rational Test Control Panel component in Rational Test Virtualization Server and Rational Test Workbench affected by Spring vulnerability (CVE-2018-15756)

Summary The Spring framework is vulnerable to a security issue affecting the Rational Test Control Panel component in Rational Test Virtualization Server and Rational Test Workbench. Vulnerability Details CVEID: CVE-2018-15756 DESCRIPTION: Pivotal Spring Framework is vulnerable to a denial of...

Cross Site Scripting (XSS)

Liferay Portal is vulnerable for Cross site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the ppid parameter in the Plugins Confguration section of Control Panel...

LogMeIn Control Panel Installed (Windows)

Binary data logmeincontrolpanelwininstalled.nbin...

nVidia control panel fails to launch in platform layer or published image

When configuring a platform layer for a vGPU, the nVidia control panel may fail to launch. The driver may be working or it may fail with code 31 or code 43, but thenVidia control panel itself will not open. You may see an event in the Windows Application event log about nvcplui.exe crashing. The...

idreamsoft iCMS Directory Traversal Vulnerability (CNVD-2019-12122)

iCMS is an efficient and simple content management system built with PHP and MySQL. A directory traversal vulnerability exists in admincp.php?app=apps&do=save in idreamsoft iCMS 7.0.13, which can be exploited to delete arbitrary folders with the help of the 'app=' parameter and uninstall requests...

idreamsoft iCMS Directory Traversal Vulnerability (CNVD-2019-12123)

iCMS is an efficient and simple content management system built with PHP and MySQL. A directory traversal vulnerability exists in admincp.php?app=apps&do=save in idreamsoft iCMS 7.0.13, which can be exploited by an attacker to create a ZIP file with the contents of an arbitrary directory and...

ABB CP400 Panel Builder TextEditor 2.0

1. EXECUTIVE SUMMARY CVSS v7.0 Vendor: ABB Equipment: CP400 Panel Builder TextEditor 2.0 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code, and cause a denial-of-service condition within the...

KLA11880 Microsoft Advisory for Adobe Flash

This update does not address any multiple security vulnerabilities. For more information, please see APSB19-01. Original advisories ADV190001 APSB19-01 Related products Adobe-Flash CVE list KB list 4480979 Solution Install necessary updates from the KB section, that are listed in your Windows...

SmartWorks Systems Pakistan 1.0 SQL Injection

Exploit Title : SmartWorks Systems Pakistan 1.0 SQL Injection Author Discovered By : KingSkrupellos Date : 30/12/2018 Vendor Homepage : smartworks.pk Tested On : Windows Exploit Risk : Medium Category : WebApps Version Information : Nginx 1.14.1 - jQuery 1.11.1 - jQuery UI 1.10.4 CWE : CWE-89...

NwebProcess India Web Design 1.0 SQL Injection

Exploit Title : NwebProcess India Web Design 1.0 SQL Injection Author Discovered By : KingSkrupellos Date : 30/12/2018 Vendor Homepage : nwebprocess.com Tested On : Windows Exploit Risk : Medium Version Information : 1.0 CWE : CWE-89 Improper Neutralization of Special Elements used in an SQL...

Bitsolution.ws ICT Consulting Firm 1.0 Bypass / SQL Injection

Exploit Title : Bitsolution.ws ICT Consulting Firm 1.0 SQL Injection / Improper Authentication Author Discovered By : KingSkrupellos Date : 30/12/2018 Vendor Homepage : bitsolution.ws Tested On : Windows Category : WebApps Exploit Risk : Medium Version Information : 1.0 CWE : CWE-287 Improper...

CVE-2018-1000884

Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Password reset code -- web/reset/index.php, line 51 that can result in Possible to determine password...

Baldr Botnet Panel Shell Upload Exploit

This module exploits an arbitrary file upload vulnerability within the Baldr stealer malware control panel when uploading victim log files which are uploaded as ZIP files. Attackers can turn this vulnerability into an RCE by first registering a new bot to the panel and then uploading a ZIP file...

CVE-2018-17777

The CVE-2018-17777 entry describes a credential-bypass on D-Link DVA-5592 A1_WI_20180823 devices. If the Parental Control PIN on the page /ui/cbpc/login is the default 0000, an attacker can bypass the login form by editing the path of the cookie sid, gaining administrator access to the router con...