1245 matches found
PT-2020-6675
Name of the Vulnerable Software and Affected Versions Ansible Engine versions 2.9.x before 2.9.3 Ansible Engine versions 2.8.x before 2.8.8 Ansible Engine versions 2.7.x before 2.7.16 and earlier Description The issue is related to the nxos file copy module in Ansible, which can be used to copy...
Ansible: malicious code could craft filename in nxos_file_copy module
A vulnerability in Ansible's nxosfilecopy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues...
Cross-Site Scripting (XSS)
fileview is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the filename parameter as there was no validation and sanitization on filenames...
Cross site scripting
Cross-site scripting XSS vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php...
CVE-2014-4535
The Import Legacy Media plugin for WordPress (version 0.1 and earlier ) is vulnerable to a Cross-site scripting (XSS) vulnerability. The root cause is a lack of proper validation of client-side data, specifically allowing remote attackers to inject arbitrary web scripts or HTML via the filename p...
CVE-2014-4544
Cross-site scripting XSS vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the Filename parameter to getid3/demos/demo.write.php...
CVE-2014-4539
Cross-site scripting XSS vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php...
Cross site scripting
Cross-site scripting XSS vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php...
CVE-2014-4544
Cross-site scripting XSS vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the Filename parameter to getid3/demos/demo.write.php...
CVE-2014-4544
Cross-site scripting XSS vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the Filename parameter to getid3/demos/demo.write.php...
CVE-2014-4539
CVE-2014-4539 : A cross-site scripting (XSS) flaw in the WordPress Movies plugin (versions 0.6 and earlier) exists due to insufficient validation in the filename parameter of getid3/demos/demo.mimeonly.php. This allows remote attackers to inject arbitrary script/HTML, potentially executing code i...
CVE-2014-4539: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php...
PT-2019-7113
Name of the Vulnerable Software and Affected Versions Movies plugin versions 0.6 and earlier for WordPress Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the filename parameter to "getid3/demos/demo.mimeonly.php". Recommendations Fo...
CVE-2014-4544: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the Filename parameter to getid3/demos/demo.write.php...
CVE-2014-4535: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php...
PT-2019-7111
Name of the Vulnerable Software and Affected Versions Import Legacy Media plugin versions 0.1 and earlier for WordPress Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the filename parameter to "getid3/demos/demo.mimeonly.php"...
The vulnerability of the Web Time and Expense interface of the integrated enterprise management system Microsoft Dynamics NAV allows a malicious individual to gain unauthorized access to arbitrary reports.
The vulnerability of the Web Time and Expense interface of the integrated enterprise management system Microsoft Dynamics NAV is related to the insecure direct object reference IDOR. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to arbitrar...
VulnCheck KEV: CVE-2013-5912
VhttpdMgr in Thomson Reuters Velocity Analytics Vhayu Analytic Server 6.94 build 2995 allows remote attackers to execute arbitrary code via a URL in the fileName parameter during an importFile action...
Parallels Plesk Panel Cross-Site Scripting Vulnerability (CNVD-2020-41525)
Parallels Plesk Panel is a control panel for the Plesk web hosting platform from Parallels USA. A cross-site scripting vulnerability exists in Parallels Plesk Panel version 9.5 in target/locales/tr-TR/help/index.htm? that can be exploited to inject JavaScript via the "fileName" parameter...
