Information Disclosure due to Out-of-scope Site Resolution

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C 3.5 Problem In multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site b...

Cross site scripting

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists on a DCE file upload endpoint when tampering with parameters over HTTP. Affected products: StruxureWare Data Center Expert V7.9.2 and prior...

CVE-2023-25551

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists on a DCE file upload endpoint when tampering with parameters over HTTP. Affected products: StruxureWare Data Center Expert V7.9.2 and prior...

SUSE CVE-2019-11455

A buffer over-read in UtilurlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service application outage...

Denial Of Service (DoS)

elog:stretch is vulnerable to denial of service This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.4-283534d. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

Integer overflow

IIPImage High Resolution Streaming Image Server prior to commit 882925b295a80ec992063deffc2a3b0d803c3195 is affected by an integer overflow in iipsrv.fcgi through malformed HTTP query parameters...

Fortinet FortiWeb 操作系统命令注入漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. management interface is vulnerable to comman...

WP Cerber Security < 8.9.3 - 2FA Authentication Bypass

The plugin improperly checked certain HTTP parameters leading to an administrative multi-factor authentication bypass...

Exploit for OS Command Injection in Zeroshell

POC CVE-2019-12725-Remote-Command-Execution ZeroShell 3.9.0 R...

CVE-2021-20698

Sharp NEC Displays UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior to it, UN552A R1.300 and prior to it, UN552S R1.300 and prior to it, UN552VS R1.300 and prior to it, UN552 R1.300 and prior to it, UN552V R1.300 and prior to i...

CVE-2021-1397

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An...

MERCUSYS Mercury X18G 安全漏洞

The Mercusys Mercury X18G is a router from the Chinese company Mercusys. A security vulnerability exists in MERCUSYS Mercury X18G 1.0.5 that allows denial of service via a crafted value to POST to listen for http LAN parameters...

SAP Manufacturing Execution Cross-Site Scripting Vulnerability

SAP Manufacturing Execution SAP ME is a powerful, scalable, enterprise-class manufacturing business solution that enables global manufacturers to manage and monitor manufacturing and shop floor operations. It provides a multi-faceted set of capabilities that integrate business systems with shop...

CVE-2021-27600

SAP Manufacturing Execution System Rules, versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution System Rules tab does not sufficiently encode some parameters, resulting in Stored...

SAP Manufacturing Execution 跨站脚本漏洞

SAP Manufacturing Execution SAP ME is a powerful, scalable, enterprise-class manufacturing business solution that enables global manufacturers to manage and monitor manufacturing and shop floor operations. It provides a multi-faceted set of capabilities that integrate business systems with shop...

CVE-2020-17502

Barco TransForm N before 3.8 allows Command Injection issue 2 of 4. The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An...

McAfee Advanced Threat Defense Information Disclosure Vulnerability (CNVD-2020-52853)

McAfee Advanced Threat Defense ATD is a suite of advanced threat protection systems from the U.S.-based company McAfee McAfee. The system provides zero-day attack protection and malware protection through static code analysis, malware dynamic analysis and machine learning. An information disclosu...

ELOG < 3.1.4 DoS Vulnerability

ELOG is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elogproject:elog";...

Null pointer dereference

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.4-283534d. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HTTP parameters. A crafted request...

CVE-2020-8859

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.4-283534d. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HTTP parameters. A crafted request...