Dell Avamar Server和Dell Avamar Virtual Edition 路径遍历漏洞

Dell Avamar Server and Dell Avamar Virtual Edition are data backup and recovery software developed by the American company Dell. Both products have a path traversal vulnerability, particularly in versions prior to 19.10 SP1 with CHF338912. This vulnerability stems from improper restrictions on...

PT-2026-20255

Name of the Vulnerable Software and Affected Versions Dell Avamar versions prior to 19.12 with patch 338905 Description Dell Avamar contains an Improper Limitation of a Pathname to a Restricted Directory vulnerability, also known as a 'Path Traversal' issue, in the Security component. A...

CVE-2026-2101 Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19

A Reflected Cross-site Scripting XSS vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 allows an attacker to execute arbitrary script code in user's browser session...

CVE-2026-2101

CVE-2026-2101 is a reflected XSS vulnerability in ENOVIAvpm Web Access, affecting ENOVIAvpm versions 1 Release 16 through 1 Release 19. The issue allows an attacker to cause arbitrary script execution in a user’s browser session after input is reflected in the response. The CVSS-3.1 base score is...

CVE-2026-2101 Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19

A Reflected Cross-site Scripting XSS vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 allows an attacker to execute arbitrary script code in user's browser session...

PT-2026-8358

Name of the Vulnerable Software and Affected Versions ENOVIAvpm Web Access versions 1 Release 16 through 1 Release 19 Description A Reflected Cross-site Scripting XSS issue exists in ENOVIAvpm Web Access. This allows an attacker to execute arbitrary script code within a user's browser session...

CVE-2019-25376

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL parameter. Attackers can send POST requests to the proxy endpoint with JavaScript code in the ignoreLogAC...

CVE-2019-25373

OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the category parameter. Attackers can send POST requests to firewallrulesedit.php with script payloads in the category field to execute...

CVE-2019-25370

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through multiple parameters. Attackers can send POST requests to interfacesvlanedit.php with script payloads in the tag, descr, or vlanif parameters ...

CVE-2019-25375

OPNsense 19.1 is affected by a reflected XSS in the monit interface via the mailserver parameter. Unauthenticated users can submit crafted input (POST to monit) containing JavaScript payloads to execute in users’ browsers. The vulnerability arises from the mailserver parameter handling and allows...

CVE-2019-25373

CVE-2019-25373 – OPNsense 19.1 Stored XSS has a vulnerability in the category field of the firewall_rules_edit.php endpoint. An authenticated user can submit crafted input via POST to this page, injecting JavaScript that is then executed in other users’ browsers when they view firewall rule pages...

EUVD-2019-19423

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. Attackers can submit crafted payloads through POST requests to diagtraceroute.php to execute...

EUVD-2019-19426

OPNsense 19.1 contains a stored cross-site scripting vulnerability in the systemadvancedsysctl.php endpoint that allows attackers to inject persistent malicious scripts via the tunable parameter. Attackers can submit POST requests with script payloads that are stored and executed in the context o...

CVE-2019-25370

OPNsense 19.1 is affected by a reflected XSS in interfaces_vlan_edit.php. The vulnerability arises from accepting crafted input in multiple parameters (tag, descr, vlanif) via POST, enabling attackers to inject and execute arbitrary JavaScript in users’ browsers. The CVE entry confirms the affect...

CVE-2019-25369

OPNsense 19.1 contains a stored cross-site scripting vulnerability in the systemadvancedsysctl.php endpoint that allows attackers to inject persistent malicious scripts via the tunable parameter. Attackers can submit POST requests with script payloads that are stored and executed in the context o...

Deciso OPNsense 跨站脚本漏洞

Deciso OPNsense is a firewall and router operating system developed by the Dutch company Deciso. Version 19.1 of Deciso OPNsense contains a cross-site scripting vulnerability. This vulnerability stems from insufficient input validation for the mailserver parameter in the monit interface, which ma...

PT-2026-8247

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the mailserver parameter. Attackers can send POST requests to the monit interface with JavaScript payloads in the mailserver...

Deciso OPNsense 跨站脚本漏洞

Deciso OPNsense is a set of open-source firewall and routing software based on FreeBSD developed by the Dutch company Deciso. Version Decivo OPNsense 19.1 contains a cross-site scripting vulnerability. This vulnerability stems from insufficient input validation of the value parameter in the...

CVE-2025-13151 affecting package libtasn1 for versions less than 4.19.0-3

CVE-2025-13151 affecting package libtasn1 for versions less than 4.19.0-3. A patched version of the package is available...

CVE-2026-2209

A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationBody.js of the component Custom Translation Handler. The manipulation results in improper authorization. The attack can be launched remotel...