3841 matches found
Octopus Deploy XSS Vulnerability
Cross-site scripting XSS vulnerability in the All Variables tab in Octopus Deploy allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and...
Octopus Deploy XSS Vulnerability
Cross-site scripting XSS vulnerability in Octopus Deploy allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright ...
PT-2017-14608 · WordPress · Updraftplus
Name of the Vulnerable Software and Affected Versions: UpdraftPlus plugin versions 1.13.12 and earlier Description: The issue allows remote PHP code execution due to a race condition in the plupload action function before deleting a file associated with the name parameter in...
Cross site scripting
Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...
CVE-2017-16801
Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...
CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2017-36502)
CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in the...
CVE-2017-16799
In CMS Made Simple 2.2.3.1, in modules/New/action.addcategory.php, stored XSS is possible via the m1name parameter to admin/moduleinterface.php during addition of a category, a related issue to CVE-2010-3882...
ManageEngine ServiceDesk Arbitrary File Download Vulnerability
ZOHO ManageEngine ServiceDesk is the United States ZhuoHao ZOHO company's set of web-based help desk HelpDesk and asset management software. An arbitrary file download vulnerability exists in ZOHO ManageEngine ServiceDesk version 9.3.9328, which stems from the program failing to restrict the...
CVE-2017-11512: Improper Limitation of a Pathname to a Restricted Directory
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...
Artica Pandora FMS Cross-Site Scripting Vulnerability
Artica Pandora FMS Flexible Monitoring System is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A cross-site scripting vulnerability exists in Artica Pandora FMS version 7.0. The vulnerabilit...
ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-35598)
ZOHO ManageEngine Applications Manager is a set of IT operations management solutions from ZOHO. A SQL injection vulnerability exists in Zoho ManageEngine Applications Manager version 13. A remote attacker can exploit this vulnerability by executing arbitrary SQL commands with the 'name' paramete...
CVE-2017-16542
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...
Sql injection
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...
CVE-2017-16542
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...
CVE-2017-16542
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...
CVE-2017-16542: Improper Neutralization of Special Elements used in an SQL Command
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...
Synology Audio Station Cross-Site Scripting Vulnerability (CNVD-2017-35648)
Synology Audio Station is an audio manager from Synology. A cross-site scripting vulnerability exists in Custom Internet Radio List in Synology Audio Station versions prior to 6.3.0-3260. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML with the 'NAME'...
CVE-2017-15888
Cross-site scripting XSS vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticated attackers to inject arbitrary web script or HTML via the NAME parameter...
CVE-2017-15888: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticated attackers to inject arbitrary web script or HTML via the NAME parameter...