CVE-2018-0635

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter...

CVE-2018-0635

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter...

CVE-2018-0635: Improper Neutralization of Special Elements used in an OS Command

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter...

PT-2019-8683

Name of the Vulnerable Software and Affected Versions Aterm HC100RC version 1.0.1 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands via the filename parameter. Recommendations For Aterm HC100RC version 1.0.1 and earlier, avoid using th...

CVE-2018-12316

OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter...

CVE-2018-12316

OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter...

PT-2018-17918

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center IMC versions prior to 7.3 E0605P06 Description The issue allows for a remote denial of service via dbman Opcode 10003 using the Filename parameter. Recommendations For versions prior to 7.3 E0605P06, update to...

TerraMaster TOS Cross-Site Scripting Vulnerability

TerraMaster TOS is a set of storage server special operating system based on Linux platform developed by Terra Master. The system supports file sharing, cloud data synchronization, data backup and virtualization, etc. Text Editor is one of the text editor. A cross-site scripting vulnerability...

CVE-2018-13360

Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter...

CVE-2018-18547

Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dira parameter, or the filename to the list/directory/ URI...

CVE-2018-18258

An issue was discovered in BageCMS 3.1.3. The attacker can execute arbitrary PHP code on the web server and can read any file on the web server via an index.php?r=admini/template/updateTpl&filename= URI...

PT-2018-13270

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns the improper restriction of modified Snippet content. This is demonstrated through the "admin/index.php?id=snippets&action=edit snippet&filename=google-analytics" URI, which allows...

CVE-2018-16059: Improper Limitation of a Pathname to a Restricted Directory

Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter...

Directory traversal

Visiology Flipbox Software Suite before 2.7.0 allows directory traversal via %5c%2e%2e%2f because it does not sanitize filename parameters...

CVE-2018-15138: Improper Limitation of a Pathname to a Restricted Directory

Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs...

man-cgi Local File Inclusion Vulnerability

Exploit for linux platform in category remote exploits man-cgi before 1.16 allows Local File Inclusion via absolute path traversal. If an Attacker provides a Filename as a Parameter e.g. https://example.org/cgi-bin/man-cgi?/etc/passwd the Script will read and return the local file. This is...

CVE-2018-1155

In SecurityCenter versions prior to 5.7.0, a cross-site scripting XSS issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue...

PT-2018-10657

Name of the Vulnerable Software and Affected Versions SecurityCenter versions prior to 5.7.0 Description A cross-site scripting issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. This is due to inadequate input...

CVE-2018-1155: Improper Neutralization of Input During Web Page Generation

In SecurityCenter versions prior to 5.7.0, a cross-site scripting XSS issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue...

Cross site scripting

script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting XSS vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each time an administrator searches or lists uploaded files. These two injections could...