4094 matches found
PT-2018-14977
Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.4 Description The issue allows for XSS via an admin's use of the name parameter in the reports section. This can be exploited through the /app/index.php/reports/default/details?id=1 API endpoint. Recommendations For Zurmo...
CVE-2018-19506: Improper Neutralization of Input During Web Page Generation
Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI...
PT-2018-14381
Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2 Description The issue allows for the injection of PHP ini-file directives through environment variables. This can be achieved by sending specific information to the attacker, such as using a name parameter...
Infovista VistaPortal SE Cross-Site Scripting Vulnerability (CNVD-2019-07227)
Infovista VistaPortal SE is a Web-based application from Infovista USA. A cross-site scripting vulnerability exists in the EditCurrentPool.jsp page in Infovista VistaPortal SE version 5.1 build 51029, which can be exploited by a remote attacker with the help of the 'PropName' parameter to inject...
CVE-2018-19927
Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zFormsavechanges sipnick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases...
ASUSTOR ADM Operating System Command Injection Vulnerability
ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. An operating system command injection vulnerability exists in the group.cgi file in ASUSTOR ADM version 3.1.1. An attacker can exploit this vulnerability by modifying the 'name' POST parameter to execute...
CVE-2018-12317
OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter...
PT-2018-11105
Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to execute system commands as root via the name POST parameter in the user.cgi module. This can be exploited by sending a malicious POST request to the vulnerable endpoint...
Drobo 5N2 Improper Access Control Vulnerability (CNVD-2019-05934)
The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. An access control error vulnerability exists in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115. An attacker c...
CVE-2018-12317: Improper Neutralization of Special Elements used in an OS Command
OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter...
CVE-2018-12307: Improper Neutralization of Special Elements used in an OS Command
OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter...
PT-2018-11116
Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to execute system commands as root by modifying the name POST parameter in the group.cgi file. This enables attackers to gain elevated access and control over the system...
CVE-2018-14695
Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter...
PT-2018-12672
Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue is related to incorrect access control in the "/mysql/api/logfile.php" endpoint, which allows unauthenticated attackers to retrieve MySQL log files. This is achieved by manipulating...
PT-2018-12666
Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns incorrect access control in the "/mysql/api/diags.php" endpoint, allowing unauthenticated attackers to retrieve diagnostic information. This is achieved via the name URL...
CVE-2018-14695: Exposure of Sensitive Information to an Unauthorized Actor
Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter...
CVE-2018-14700: Insertion of Sensitive Information into Log File
Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL log files via the "name" URL parameter...
Buffalo TS5600D1206 Command Injection Vulnerability (CNVD-2019-00674)
The Buffalo TS5600D1206 is a network storage device from the Buffalo Group of Japan. A command injection vulnerability exists in the User.create method in the Buffalo TS5600D1206 version 3.61-0.10, which can be exploited to execute system commands with the 'name' parameter...
