Design/Logic Flaw

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page...

CVE-2019-13476: Improper Neutralization of Input During Web Page Generation

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page...

PT-2019-4344 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.837 Description: The issue is related to a lack of protection for the web page structure, allowing a low-privilege user to achieve root access via the email list page. This can be exploited by a remote attacker ...

CVE-2018-18547

Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dira parameter, or the filename to the list/directory/ URI...

PT-2018-14507

Name of the Vulnerable Software and Affected Versions Vesta Control Panel versions prior to 0.9.8-22 Description The issue allows for XSS attacks through various parameters, including the domain parameter in the "edit/web/" endpoint, the backup parameter in the "list/backup/" endpoint, the period...

CVE-2018-18547: Improper Neutralization of Input During Web Page Generation

Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dira parameter, or the filename to the list/directory/ URI...

CVE-2018-3955

An exploitable operating system command injection exists in the Linksys ESeries line of routers Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04. Specially crafted entries to network configuration information can cause execution of arbitrary system commands, resulti...

DEBIAN-CVE-2018-12561

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as filemode= by manipulating for example the domain parameter of the samba URL...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15878)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "Join Domain" method in Quest DR Series Disk Backup Software versions prior to 4.0.3.1. The vulnerability can be exploited to execute system commands via the 'domain' parameter...

CVE-2017-17594

DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability

Openfire is a cross-platform real-time collaboration server based on the XMPP Jabber protocol. A cross-site scripting vulnerability exists in the administration console in Ignite Realtime Openfire server versions prior to 4.1.7. An attacker can execute arbitrary JavaScript code on the victim clie...

CVE-2014-1203

The getloginipconfigfile function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/iploginset/diploginget.php...

PT-2017-5797

Name of the Vulnerable Software and Affected Versions: Eyou Mail System versions prior to 3.6 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to the "/admin/domain/ip login set/d ip login get.php" API endpoint. This is...

CVE-2014-1203: Improper Neutralization of Special Elements used in a Command

The getloginipconfigfile function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/iploginset/diploginget.php...

Turbomail email system domain parameter has SQL injection vulnerability

TurboMail email system is an email server system developed for the communication needs of enterprises and institutions. A SQL injection vulnerability exists in the domain parameter of the Turbomail mail system due to the system's failure to strictly filter the parameters entered by the user. An...

Open Source Solutions ViMbAdmin Cross-Site Scripting Vulnerability

Open Source Solutions ViMbAdmin is an open source Web-based virtual mailbox management system from Open Source Solutions, Ireland. The system supports administrators to manage domains , mail and aliases and so on. A cross-site scripting vulnerability exists in Open Source Solutions ViMbAdmin...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ViMbAdmin 3.0.15 allow remote attackers to inject arbitrary web script or HTML via the 1 domain or 2 transport parameter to domain/add; the 3 name parameter to mailbox/add/did/; the 4 goto parameter to alias/add/did/; or the 5 captchatext...

CVE-2017-5870: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ViMbAdmin 3.0.15 allow remote attackers to inject arbitrary web script or HTML via the 1 domain or 2 transport parameter to domain/add; the 3 name parameter to mailbox/add/did/ ; the 4 goto parameter to alias/add/did/ ; or the 5 captchatext...

Rumble Mail Server 0.51.3135 Cross Site Scripting

Exploit title: Rumble Mail Server v/0.51.3135 = Stored Cross Site Scripting Download Software: https://sourceforge.net/projects/rumble/?source=directory Author: Nassim Asrir Author Company: Henceforth Contact: [email protected] Tested On: Win7 What is Rumble: --------------------------------...

CVE-2015-4854

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Single Signon. NOTE: the previous information is from the October 2015 CPU. Oracle...