17077 matches found
Design/Logic Flaw
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions...
Design/Logic Flaw
handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...
Design/Logic Flaw
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMDEXEC virtual device type 28...
Design/Logic Flaw
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command as well as "Set root password" are exposed...
Design/Logic Flaw
Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API...
velo-design.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-930391 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting velo-design.com website an...
Design/Logic Flaw
A remote gain authorized access vulnerability was discovered in HPE 3PAR Service Processor versions: prior to 5.0.5.1...
Design/Logic Flaw
OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user...
Design/Logic Flaw
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cpcontactformpaypal.php&pwizard=1 cpcontactformppid parameter...
CVE-2019-14747
DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter...
Cross site scripting
DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter...
CVE-2019-14747
DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter...
Design/Logic Flaw
cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation SEC-137...
Design/Logic Flaw
cPanel before 57.9999.105 allows newline injection via LOC records CPANEL-6923...
Design/Logic Flaw
Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users editor or developer to create an administrator account via admin/user/add, as demonstrated by a Python PoC script...
Design/Logic Flaw
In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended...
Design/Logic Flaw
Leech Protect in cPanel before 62.0.4 does not protect certain directories SEC-205...
Design/Logic Flaw
cPanel before 62.0.4 allows reflected XSS in reset-password interfaces SEC-198...