3288 matches found
Rasilient PixelStor 5000 Remote Code Execution Vulnerability
The Rasilient PixelStor 5000 is a low-cost, high-bandwidth and high-availability RAID disk array. A remote code execution vulnerability exists in the contentHostProperties.php file in the Rasilient PixelStor 5000 K: 4.0.1580-20150629 KDI version release, which can be exploited by an attacker to...
CVE-2020-5307
PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in...
CVE-2013-3931
Cross-site scripting XSS vulnerability in the Jomres comjomres component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permission to inject arbitrary web script or HTML via the propertyname parameter, related to editing property details...
CVE-2019-11399
An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices. OS command injection occurs through the getset.ccp lanHostCfgHostName1.1.1.0.0 parameter...
The vulnerability of the “Service Name” parameter in the TP-Link M7350 route blocker software exists because measures to neutralize special elements used in the operating system are not taken. This allows a hacker to execute arbitrary commands.
The vulnerability of the “Service Name” parameter in the TP-Link M7350 route switch software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
CVE-2019-18793
Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter...
CVE-2019-16950
An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript...
The vulnerability of the safer_name_suffix function in the GNU Tar archive manager allows a hacker to bypass the intended security measures and write data to arbitrary files.
The vulnerability of the safernamesuffix function in the GNU Tar archive manager exists due to an incorrect restriction on the pathname to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to bypass the intended security measures and write to arbitrary...
Design/Logic Flaw
DISPUTED Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to...
CVE-2019-16925
Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change th...
CVE-2019-16925
CVE-2019-16925 affects Flower 0.9.3, with an XSS vulnerability reported via the name parameter in an @app.task call. The core issue appears to be unvalidated client-side data in the Flower web interface, but multiple sources note the project author disputes the vulnerability’s validity and emphas...
PT-2019-14872 · Celery · Flower
Name of the Vulnerable Software and Affected Versions: Flower version 0.9.3 Description: The issue concerns a potential XSS via the name parameter in an @app.task call. However, the project author disputes the validity of this issue, stating that worker and task names are internal backend...
PT-2019-7754 · WordPress · Colorway
Name of the Vulnerable Software and Affected Versions: Colorway theme versions prior to 3.4.2 for WordPress Description: The issue concerns a Cross-Site Scripting XSS problem. It is related to the contactName parameter. There is no information provided about the estimated number of potentially...
PT-2019-7755 · WordPress · Icegram
Name of the Vulnerable Software and Affected Versions: icegram plugin versions prior to 1.9.19 Description: The issue concerns a CSRF vulnerability via the option name parameter in the "wp-admin/edit.php" endpoint. This allows for potential unauthorized actions. Recommendations: For versions prio...
CVE-2019-14747
DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter...
PT-2019-12511 · Synology · Synology Moments
Name of the Vulnerable Software and Affected Versions: Synology Moments versions prior to 1.3.0-0691 Description: The issue concerns a relative path traversal vulnerability. It allows remote authenticated users to upload arbitrary files via the name parameter. Recommendations: For versions prior ...
CVE-2017-8329
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of setting a name for the wireless network. These values are stored by the device in NVRAM Non-volatile RAM. It seems that the POST parameters passed ...
CVE-2019-11226
CMS Made Simple 2.2.10 has XSS via the m1name parameter in "Add Article" under Content - Content Manager - News...
HPE Intelligent Management powershellConfigContent Code Execution Vulnerability
HPE Intelligent Management Center is a suite of network intelligence management center solutions. A code execution vulnerability exists in the handling of the HPE Intelligent Management Center powershellConfigContent beanName parameter, which can be exploited by an attacker to submit a special...