Circle with Disney Apid Photo Upload Denial of Service Vulnerability(CVE-2017-2884)

Summary An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1. A repeated set of specially crafted API calls can cause the device to corrupt essential memory, resulting in a bricked device. An attacker needs network connectivity to...

DALIM SOFTWARE ES Core 5.0 Build 7184.1 XSS / CSRF

!-- DALIM SOFTWARE ES Core 5.0 build 7184.1 Multiple Stored XSS And CSRF Vulnerabilities Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0 build 7114.1 build 7114.0 build 7093.1 build 7093.0 buil...

Sql injection

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/sysarticle.php via $POST'parentid', $POST'desc', $POST'keys', and $POST'level'...

Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23890)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the /apps/apparticle/controller/editor.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the help of $POST'id'...

Cross site scripting

ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated...

UBUNTU-CVE-2017-7416

ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated...

CVE-2017-7416

ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated...

CVE-2017-7416

Removed by vendor...

CVE-2017-6629

A vulnerability in the ImageID parameter of Cisco Unity Connection 10.52 could allow an unauthenticated, remote attacker to access files in arbitrary locations on the filesystem of an affected device. The issue is due to improper sanitization of user-supplied input in HTTP POST parameters that...

Cisco Unity Connection ImageID Parameter Unauthorized Access Vulnerability

A vulnerability in the ImageID parameter of Cisco Unity Connection could allow an unauthenticated, remote attacker to access files in arbitrary locations on the filesystem of an affected device. The issue is due to improper sanitization of user-supplied input in HTTP POST parameters that describe...

Moxa AWK-3131A Web Application Cleartext Transmission of Password Vulnerability

Summary An exploitable Cleartext Transmission of Password vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. The Change Password functionality of the Web Application transmits the password in cleartext. An attacker capable of...

Cross-Site Request Forgery (CSRF) Via Leakage Of Authenticity Token

omniauth is susceptible to cross-site request forgery attacks. The attacks are possible because it stores POST parameters in addition to GET parameters in callback phase, thereby exposing authenticitytokens from the POST parameters and leading to bypass of cross-site request forgery protection...

InfraPower PPS-02-S Q213V1 - Remote Command Execution

InfraPower PPS-02-S Q213V1 - Remote Command Execution InfraPower PPS-02-S Q213V1 Unauthenticated Remote Root Command Execution Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Fixed version: Q216V3 Firmware:...

Iris ID IrisAccess ICU 7000-2 - Remote Command Execution

Iris ID IrisAccess ICU 7000-2 - Remote Command Execution Iris ID IrisAccess ICU 7000-2 Remote Root Command Execution Vendor: Iris ID, Inc. Product web page: http://www.irisid.com http://www.irisid.com/productssolutions/hardwareproducts/icu-7000-2/ Affected version: ICU Software: 1.00.08 ICU OS:...

Iris ID IrisAccess ICU 7000-2 - Remote Command Execution

Iris ID IrisAccess ICU 7000-2 Remote Root Command Execution Vendor: Iris ID, Inc. Product web page: http://www.irisid.com http://www.irisid.com/productssolutions/hardwareproducts/icu-7000-2/ Affected version: ICU Software: 1.00.08 ICU OS: 1.3.8 ICU File system: 1.3.8 EIF Firmware Channel 1: 1.9...

Ubiquiti Administration Portal CSRF to Remote Command Execution

Vulnerability Details Affected Vendor: Ubiquiti Affected Product: AirGateway, AirFiber, mFi Affected Version: 1.1.6, 3.2, 2.1.11 Platform: Embedded Linux CWE Classification: CWE-352: Cross-Site Request Forgery CSRF; CWE-77: Improper Neutralization of Special Elements used in a Command 'Command...

Farmers-government system /ExtWebModels/WebManage/ProductList. aspx POST parameters PName SQL injection vulnerability

No description provided by source...

NationBuilder - Multiple Persistent Cross-Site Scripting Vulnerabilities

Exploit for multiple platform in category web applications 1 Stored XSS in 'signupnote' POST parameter ---------------------------------------------- PoC: input type="hidden"...

NationBuilder Cross Site Scripting

1 Stored XSS in 'signupnote' POST parameter ---------------------------------------------- PoC: input type="hidden" name="authenticitytoken" value="0ch5v8vyarO/yzmWoLWtOKBVpOjVVaQe/V8yg5jfNO8="...

Hippo CMS 10.1 Stored Cross Site Scripting

" / " / input type="...