Sitemagic CMS Cross-Site Scripting Vulnerability

Sitemagic CMS is a scalable content management system CMS. A cross-site scripting vulnerability exists in the SMFiles/FrmUpload.class.php file in Sitemagic CMS v4.4, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'filename' parameter...

CVE-2019-10238

Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...

CVE-2019-10238

Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...

CVE-2019-10238: Improper Neutralization of Input During Web Page Generation

Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...

PT-2019-11650

Name of the Vulnerable Software and Affected Versions: Sitemagic CMS version 4.4 Description: The issue concerns a security problem where an attacker can inject malicious code. This is achieved through the filename parameter in the SMFiles/FrmUpload.class.php file. Recommendations: For Sitemagic...

Humhub cross-site scripting vulnerability (CNVD-2019-12169)

Humhub is a set of open source social networking software based on the Yii PHP framework written . A cross-site scripting vulnerability exists in file/file/upload in version 1.3.10 of Humhub Community Edition. A remote attacker can use the 'filename' parameter to inject arbitrary web script or HT...

Deserialization of Untrusted Data

Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It is possible insert the php wrapper “phar” with an arbitrary path in filename parameter that allows arbitrary code...

CVE-2019-9093

A Reflected Cross Site Scripting XSS Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing a JavaScript payload in the filename parameter is echoed back, which resulted in reflected XSS...

PT-2019-2176

Name of the Vulnerable Software and Affected Versions Акцент affected versions not specified Description The issue exists due to insufficient checking of the filename POST parameter in the /handlers/download.php script. This allows a remote attacker to read the contents of arbitrary files on the...

PT-2019-19357

Name of the Vulnerable Software and Affected Versions Humhub version 1.3.10 Community Edition Description A Reflected Cross Site Scripting XSS issue was found in the file upload functionality. Specifically, user-supplied input containing a JavaScript payload in the filename parameter is echoed...

CVE-2019-9093: Improper Neutralization of Input During Web Page Generation

A Reflected Cross Site Scripting XSS Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing a JavaScript payload in the filename parameter is echoed back, which resulted in reflected XSS...

PT-2019-9645 · Netdata +4 · Netdata +4

Name of the Vulnerable Software and Affected Versions: Netdata version 1.10.0 Description: An issue exists in the software where HTTP Header Injection is possible via the filename parameter in the "api/v1/data" endpoint. This is due to the web client api request v1 data function in web/api/web ap...

Design/Logic Flaw

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request...

CVE-2019-9632

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request...

CVE-2019-9632

CVE-2019-9632 affects ESAFENET CDG V3 and V5. The vulnerability enables arbitrary file download via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request. Reported impact is information disclosure; CVSSv3 base score 7.5 (HI...

CVE-2019-9632: Undefined Security Weakness

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request...

CVE-2019-8407

HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI...

PT-2019-19015

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file read and write operations. This is achieved by utilizing a ../ in the filename parameter to the "admin/index.php/language/edit" API endpoint. Recommendations For HongCMS...

CVE-2019-8407: Improper Limitation of a Pathname to a Restricted Directory

HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI...

NEC Aterm HC100RC OS Command Injection Vulnerability (CNVD-2019-01107)

The NEC Aterm HC100RC is a network camera from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm HC100RC using firmware version 1.0.1 and earlier. The vulnerability can be exploited to execute arbitrary operating system commands with the 'filename'...