713 matches found
PT-2021-22056
Name of the Vulnerable Software and Affected Versions: RSVPMaker Excel WordPress plugin versions up to and including 1.1 Description: The issue is related to Reflected Cross-Site Scripting, which occurs due to a reflected $ SERVER"PHP SELF" value in the...
CVE-2021-38337: Improper Neutralization of Input During Web Page Generation
The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1...
PT-2021-17018
Name of the Vulnerable Software and Affected Versions VembuBDR versions prior to 4.2.0.1 VembuOffsiteDR versions prior to 4.2.0.1 Description The issue allows an unauthenticated attacker to execute arbitrary OS commands with SYSTEM privileges. This can be achieved by exploiting the http API locat...
CVE-2021-26472: Improper Neutralization of Special Elements used in an OS Command
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges...
Server side request forgery (ssrf)
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...
CVE-2020-24063
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...
CVE-2020-24063: Server-Side Request Forgery (SSRF)
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...
PT-2020-15635
Name of the Vulnerable Software and Affected Versions Canto plugin version 1.3.0 for WordPress Description The issue allows for Server-Side Request Forgery SSRF via the "includes/lib/download.php" endpoint with the subdomain parameter. Recommendations For Canto plugin version 1.3.0, consider...
PT-2020-16205
Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.24.3 Description An issue allows users without access to view private issue notes to download supposedly private attachments linked to these notes by directly accessing the corresponding file download URL...
ZoneMinder < 1.34.21 Multiple XSS Vulnerabilities
ZoneMinder is prone to multiple cross-site scripting XSS vulnerabilities via the connkey parameter to download.php or export.php. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2020-52938)
ZoneMinder is a free and open source CCTV software application for Linux environments that supports IP, USB and analog cameras. A cross-site scripting vulnerability exists in ZoneMinder version 1.34.21. The vulnerability can be exploited to conduct cross-site scripting attacks via the connkey...
ALPINE-CVE-2020-25729
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php...
CVE-2020-25729
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php...
CVE-2020-25729
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php...
Design/Logic Flaw
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php...
CVE-2020-25729
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php...
CVE-2020-25729
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php...
CVE-2020-25729
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php...
CVE-2020-25729
ZoneMinder prior to 1.34.21 is affected by a cross-site scripting (XSS) vulnerability via the connkey parameter in download.php or export.php. The issue is documented across multiple sources (NVD, RH, CNVD, OSV, etc.) with the same description, indicating the vulnerability stems from unsanitized ...
PT-2020-16174
Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.34.21 Description The issue allows for XSS via the connkey parameter to "download.php" or "export.php" API endpoints. Recommendations For versions prior to 1.34.21, update to version 1.34.21 or later to resolve t...