CVE-2017-7416

ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated...

Cross site scripting

ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated...

CVE-2017-7416

Removed by vendor...

CVE-2017-6629

A vulnerability in the ImageID parameter of Cisco Unity Connection 10.52 could allow an unauthenticated, remote attacker to access files in arbitrary locations on the filesystem of an affected device. The issue is due to improper sanitization of user-supplied input in HTTP POST parameters that...

Cisco Unity Connection ImageID Parameter Unauthorized Access Vulnerability

A vulnerability in the ImageID parameter of Cisco Unity Connection could allow an unauthenticated, remote attacker to access files in arbitrary locations on the filesystem of an affected device. The issue is due to improper sanitization of user-supplied input in HTTP POST parameters that describe...

Moxa AWK-3131A Web Application Cleartext Transmission of Password Vulnerability

Summary An exploitable Cleartext Transmission of Password vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. The Change Password functionality of the Web Application transmits the password in cleartext. An attacker capable of...

Cross-Site Request Forgery (CSRF) Via Leakage Of Authenticity Token

omniauth is susceptible to cross-site request forgery attacks. The attacks are possible because it stores POST parameters in addition to GET parameters in callback phase, thereby exposing authenticitytokens from the POST parameters and leading to bypass of cross-site request forgery protection...

InfraPower PPS-02-S Q213V1 - Remote Command Execution

InfraPower PPS-02-S Q213V1 - Remote Command Execution InfraPower PPS-02-S Q213V1 Unauthenticated Remote Root Command Execution Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Fixed version: Q216V3 Firmware:...

Iris ID IrisAccess ICU 7000-2 - Remote Command Execution

Iris ID IrisAccess ICU 7000-2 - Remote Command Execution Iris ID IrisAccess ICU 7000-2 Remote Root Command Execution Vendor: Iris ID, Inc. Product web page: http://www.irisid.com http://www.irisid.com/productssolutions/hardwareproducts/icu-7000-2/ Affected version: ICU Software: 1.00.08 ICU OS:...

Iris ID IrisAccess ICU 7000-2 - Remote Command Execution

Iris ID IrisAccess ICU 7000-2 Remote Root Command Execution Vendor: Iris ID, Inc. Product web page: http://www.irisid.com http://www.irisid.com/productssolutions/hardwareproducts/icu-7000-2/ Affected version: ICU Software: 1.00.08 ICU OS: 1.3.8 ICU File system: 1.3.8 EIF Firmware Channel 1: 1.9...

Ubiquiti Administration Portal CSRF to Remote Command Execution

Vulnerability Details Affected Vendor: Ubiquiti Affected Product: AirGateway, AirFiber, mFi Affected Version: 1.1.6, 3.2, 2.1.11 Platform: Embedded Linux CWE Classification: CWE-352: Cross-Site Request Forgery CSRF; CWE-77: Improper Neutralization of Special Elements used in a Command 'Command...

Farmers-government system /ExtWebModels/WebManage/ProductList. aspx POST parameters PName SQL injection vulnerability

No description provided by source...

NationBuilder - Multiple Persistent Cross-Site Scripting Vulnerabilities

Exploit for multiple platform in category web applications 1 Stored XSS in 'signupnote' POST parameter ---------------------------------------------- PoC: input type="hidden"...

NationBuilder Cross Site Scripting

1 Stored XSS in 'signupnote' POST parameter ---------------------------------------------- PoC: input type="hidden" name="authenticitytoken" value="0ch5v8vyarO/yzmWoLWtOKBVpOjVVaQe/V8yg5jfNO8="...

Hippo CMS 10.1 Stored Cross Site Scripting

" / " / input type="...

WordPress Users Ultra 1.5.50 SQL Injection

Exploit Title: WordPress Users Ultra Plugin Blind SQL injection Discovery Date: 2015/10/19 Public Disclosure Date: 2015/12/01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://usersultra.com Software Link: https://wordpress.org/plugins/users-ultra/...

R-Scripts VRS 7R Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

PHP Vacation Rental Script version 7R suffers from cross site request forgery and cross site scripting vulnerabilities. R-Scripts VRS 7R Multiple Stored XSS And CSRF Vulnerabilities Vendor: R-Scripts Product web page: http://www.r-scripts.com Affected version: 7R Summary: PHP Vacation Rental Scri...

Mail.ru: [account.my.com] Reflected XSS

Reflected XSS via POST parameters in account.my.com. account.my.com is not covered by bug bounty scope...

Mail.ru: [allods.my.com] Reflected XSS

Browser-specific reflected XSS via POST parameters in allods.my.com. allods.my.com is not covered by bug bounty scope...

Mail.ru: [support.my.com] Reflected XSS

Reflected XSS via POST parameters in support.my.com. support.my.com is not covered by bug bounty scope...