10300 matches found
CVE-2005-3056: Improper Neutralization of Special Elements in Output Used by a Downstream Component
TWiki allows arbitrary shell command execution via the Include function...
CVE-2019-18385
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring...
CVE-2019-18385: Insertion of Sensitive Information into Log File
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring...
PT-2019-15391
Name of the Vulnerable Software and Affected Versions TerraMaster FS-210 version 4.0.19 Description An issue allows an unauthenticated attacker to download log files. This can be achieved via the "include/makecvs.php?Event=" substring, which is likely an API endpoint. The Event variable seems to ...
Directory Traversal
librenms/librenms is vulnerable to directory traversal. The usage of mysqlrealescapestring to sanitize untrusted user supplied data that is subsequently passed to the include function as a file path in csv.php, is insecure. An attacker could potentially include arbitrary files on the server using...
Remote code execution
In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution...
CVE-2019-16114
In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution...
CVE-2019-10666: Inclusion of Functionality from Untrusted Control Sphere
An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include function on user supplied input without sanitizing the values by calling basename or a similar function. An attacker can leverage this to execute PHP code from the included...
PT-2019-11979
Name of the Vulnerable Software and Affected Versions LibreNMS versions through 1.47 Description An issue was discovered in LibreNMS where several scripts perform dynamic script inclusion via the include function on user-supplied input without sanitizing the values. This allows an attacker to...
PT-2019-14518
Name of the Vulnerable Software and Affected Versions ATutor version 2.2.4 Description The issue allows an unauthenticated attacker to modify application settings, forcing the application to use a crafted database. This enables the attacker to gain access to the application. Furthermore, the...
CVE-2019-16114: Incorrect Authorization
In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution...
Exploit for Cross-site Scripting in Atlassian Html_Include_And_Replace_Macro
CVE-2019-15053 FAB-2019-00156 Vulnerability discoverd by me...
CVE-2019-15053
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element...
Design/Logic Flaw
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element...
CVE-2019-15053
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element...
CVE-2019-15053
The CVE-2019-15053 issue affects the HTML Include and replace macro plugin for Confluence Server (pre-1.5.0). A bypass of the includeScripts=false XSS protection via an IFRAME vector is documented, enabling cross-site scripting. Connected sources show a public exploit draft and vendor advisories ...
CVE-2019-15053: Improper Neutralization of Input During Web Page Generation
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element...
TeamPass <= 2.1.27.36 Multiple XSS Vulnerabilities
TeamPass is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...