CVE-2018-11589

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the...

CVE-2018-11589

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the...

DEBIAN-CVE-2018-12689

phpLDAPadmin 1.2.2 allows LDAP injection via a crafted serverid parameter in a cmd.php?cmd=loginform request, or a crafted username and password in the login panel...

UBUNTU-CVE-2018-12689

phpLDAPadmin 1.2.2 allows LDAP injection via a crafted serverid parameter in a cmd.php?cmd=loginform request, or a crafted username and password in the login panel...

PT-2018-11327

Name of the Vulnerable Software and Affected Versions Portainer versions prior to 1.18.0 Description The issue allows remote attackers to bypass intended access restrictions or conduct SSRF attacks due to unauthenticated requests to the websocket endpoint with an unvalidated id query parameter fo...

iCMS SQL Injection Vulnerability (CNVD-2018-14361)

iCMS is a content management system CMS built with PHP and MySQL databases. A SQL injection vulnerability exists in the spider.admincp.php file in iCMS version 7.0.8. A remote attacker can exploit this vulnerability by sending an app=spider&do=batch request with the 'id' parameter to the...

CVE-2018-12498

spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...

CVE-2018-12498: Improper Neutralization of Special Elements used in an SQL Command

spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...

Synology Calendar Improper Authorization Vulnerability

Synology Calendar is a file protection program from Synology that runs on Synology NAS devices. An authorization issue vulnerability exists in SYNO.Cal.Event in Synology Calendar. A remote attacker can exploit this vulnerability to create arbitrary events with the 'calid' or 'originalcalid'...

PT-2018-11218

Name of the Vulnerable Software and Affected Versions iCMS version 7.0.8 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the id parameter in an "app=spider&do=batch" request to the "admincp.php" endpoint. Recommendations For iCMS version 7.0.8, avoid using th...

Dimofinf CMS Cross-Site Scripting Vulnerability

Dimofinf CMS is an Arabic content management system CMS written in PHP. A cross-site scripting vulnerability exists in the news.php file in Dimofinf CMS version 3.0.0. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or HTML with the help of the 'id' paramete...

CVE-2018-12094

Cross-site scripting XSS vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2018-12094

Cross-site scripting XSS vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2018-12094: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

PT-2018-11007

Name of the Vulnerable Software and Affected Versions Dimofinf CMS version 3.0.0 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the id parameter in the news.php file. Recommendatio...

Quest KACE System Management Appliance SQL Injection Vulnerability

Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A SQL injection vulnerability exists in the '/common/runreport.php' script in version 8.0.318 of the Quest KACE System Management Appliance, which stems from the program not filtering incoming...

CVE-2018-10759

PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQL statements via the id parameter...

CVE-2018-10759

PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQL statements via the id parameter...

CVE-2018-10759

PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQL statements via the id parameter...