CVE-2017-17916: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the 'findby' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted...

CVE-2017-16768

Cross-site scripting XSS vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary HTML via the name parameter...

Command injection

FS Lynda Clone has XSS via the keywords parameter to tutorial/ or the editprofilefirstname parameter to user/editprofile...

CVE-2017-16768: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary HTML via the name parameter...

PT-2017-14549

Name of the Vulnerable Software and Affected Versions Synology MailPlus Server versions prior to 1.4.0-0415 Description A cross-site scripting XSS issue exists in the User Policy editor, allowing remote authenticated users to inject arbitrary HTML via the name parameter. This could potentially le...

TP-LINK TL-WR741N and TL-WR741ND 150M Wireless Lite N Router Code Execution Vulnerability

TP-LINK TL-WR741N and TL-WR741ND 150M Wireless Lite N Router are both wireless router products from China P&L TP-LINK. A security vulnerability exists in the TP-LINK TL-WR741N and TL-WR741ND 150M Wireless Lite N Router using firmware version 3.11.7 Build 100603 Rel.56412n and hardware version...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775

Piwigo 2.9.2 is vulnerable to a cross-site scripting (XSS) flaw triggered by the name parameter in an admin.php?page=album-3-properties request. The issue affects the web-based photo gallery software as described in CVE-2017-17775; details in connected records confirm the vulnerability class and ...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775: Improper Neutralization of Input During Web Page Generation

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

PT-2017-14537

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions 6.1.1030.1 and prior Description A SQL Injection issue was discovered, which generates an error in the database log. This issue allows for potential information disclosure. Recommendations For versions 6.1.1030.1 and...

PT-2017-14992

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue allows for XSS via the name parameter in an "admin.php?page=album-3-properties" request. Recommendations For Piwigo version 2.9.2, avoid using the name parameter in the...

Synology MailPlus Server Disclaimer Cross-Site Scripting Vulnerability

Synology MailPlus Server is an email service suite from Synology. The product supports managing user accounts, email records, etc. Disclaimer is one of the disclaimer modules. A cross-site scripting vulnerability exists in Disclaimer in Synology MailPlus Server versions prior to 1.4.0-0415. A...

CVE-2017-15890

Cross-site scripting XSS vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary web script or HTML via the NAME parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary web script or HTML via the NAME parameter...

CVE-2017-15890

Cross-site scripting XSS vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary web script or HTML via the NAME parameter...

CVE-2017-15890

Cross-site scripting XSS vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary web script or HTML via the NAME parameter...

CVE-2017-15890: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary web script or HTML via the NAME parameter...

PT-2017-14268

Name of the Vulnerable Software and Affected Versions Synology MailPlus Server versions prior to 1.4.0-0415 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via the NAME parameter. Recommendations For versions prior to...