CVE-2018-15612: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1...

Siemens TD Keypad Designer DLL Hijacking Vulnerability

Siemens TD Keypad Designer is a keyboard design program from Siemens Germany for Siemens TD 100C and other products. A DLL hijacking vulnerability exists in SIEMENS TD Keypad Designer all versions. An attacker could exploit the vulnerability to execute code with the privileges of the user running...

CVE-2018-16975

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with ?php content, because of insufficient input validation in...

CVE-2018-13806

CVE-2018-13806 is a DLL hijacking vulnerability in Siemens TD Keypad Designer (all versions). The root cause is an uncontrolled search path element that could allow code execution with the user’s privileges when a TD project is opened. The attacker must have write access to the directory containi...

CVE-2018-13806

A vulnerability has been identified in SIEMENS TD Keypad Designer All versions. A DLL hijacking vulnerability exists in all versions of SIEMENS TD Keypad Designer which could allow an attacker to execute code with the permission of the user running TD Designer. The attacker must have write access...

CVE-2018-13806

A vulnerability has been identified in SIEMENS TD Keypad Designer All versions. A DLL hijacking vulnerability exists in all versions of SIEMENS TD Keypad Designer which could allow an attacker to execute code with the permission of the user running TD Designer. The attacker must have write access...

Design/Logic Flaw

A vulnerability has been identified in SIEMENS TD Keypad Designer All versions. A DLL hijacking vulnerability exists in all versions of SIEMENS TD Keypad Designer which could allow an attacker to execute code with the permission of the user running TD Designer. The attacker must have write access...

PT-2018-13807

Name of the Vulnerable Software and Affected Versions Elefant CMS versions prior to 2.0.7 Description The issue is related to a PHP Code Execution Vulnerability. It can be exploited through the /designer/add/stylesheet.php endpoint by using a .php extension in the New Stylesheet Name field in...

CVE-2018-13806: Uncontrolled Search Path Element

A vulnerability has been identified in SIEMENS TD Keypad Designer All versions. A DLL hijacking vulnerability exists in all versions of SIEMENS TD Keypad Designer which could allow an attacker to execute code with the permission of the user running TD Designer. The attacker must have write access...

PT-2018-1570

Name of the Vulnerable Software and Affected Versions SIEMENS TD Keypad Designer All versions Description A DLL hijacking issue exists in SIEMENS TD Keypad Designer, allowing an attacker to execute code with the permission of the user running TD Designer. The attacker must have write access to th...

ICSA-18-254-03 Siemens TD Keypad Designer

1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: TD Keypad Designer Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a local low-privileged attacker to escalate their...

DLL Hijacking Vulnerability in siemens TD Keypad Designer

TD Keypad Designer is siemens' specialized keyboard designer for TD 100C , TD 200C , TD 400C . siemens TD Keypad Designer V1.0.9.25 suffers from a DLL hijacking vulnerability when processing td1 files, which can be exploited by attackers to load a malicious dll and execute malicious code...

Advantech WebAccess HMI Designer Detection (Windows SMB Login)

Detects the installed version of Advantech WebAccess HMI Designer. The script logs in via smb, searches for SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

(0Day) Advantech WebAccess HMI Designer PM3 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess HMI Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Updated phpmyadmin packages fix security vulnerability

A Cross-Site Scripting vulnerability was found in the Designer feature, where an attacker can deliver a payload to a user through a specially-crafted database name...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Integration Designer used in IBM Business Process Manager

Summary There are vulnerabilities in IBM SDK Java™ Technology Edition that is used by IBM Integration Designer in IBM Business Process Manager. These issues were disclosed as part of the IBM Java SDK updates in January 2018. Vulnerability Details CVEID: CVE-2018-2633 DESCRIPTION: An unspecified...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Integration Designer used in IBM Business Process Manager

Summary There are vulnerabilities in IBM SDK Java™ Technology Edition that is used by IBM Integration Designer in IBM Business Process Manager. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details CVEID: CVE-2018-2783 DESCRIPTION: An unspecified...

Cross-site Scripting (XSS)

phpmyadmin is vulnerable to cross-site scripting XSS attacks. A malicious user can use the database variable to inject and execute arbitrary Javascript when the database variable is called through the designer feature...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM Process Designer used in IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Lombardi Edition (CVE-2018-2783)

Summary There is a vulnerability CVE-2018-2783 in IBM® SDK Java™ Technology Edition that is used by IBM Process Designer in IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Lombardi Edition. The issue was disclosed as part of the IBM Java SDK updates in April 2018...

phpMyAdmin cross-site scripting vulnerability (CNVD-2018-11976)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A cross-site scripting vulnerability exists in the...