10025 matches found
PT-2019-13568
Name of the Vulnerable Software and Affected Versions Alcatel-Lucent Enterprise ALE 8008 Cloud Edition Deskphone VoIP phone version 1.50.13 Description A command injection issue due to missing input validation in the password change field of the Change Password interface allows an authenticated...
CVE-2019-14260: Improper Neutralization of Special Elements used in an OS Command
On the Alcatel-Lucent Enterprise ALE 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection missing input validation issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands...
Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection Vulnerability
Exploit for jsp platform in category web applications Unauthenticated XML External Entity XXE in Ahsay Backup v7.x - v8.1.0.50. Date: 26-6-2019 Exploit Author: Wietse Boonstra Vendor Homepage: https://ahsay.com Software Link: http://ahsay-dn.ahsay.com/v8/81050/cbs-win.exe Version: 7.x...
Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection
Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection Unauthenticated XML External Entity XXE in Ahsay Backup v7.x - v8.1.0.50. Date: 26-6-2019 Exploit Author: Wietse Boonstra Vendor Homepage: https://ahsay.com Software Link: http://ahsay-dn.ahsay.com/v8/81050/cbs-win.exe Version: 7.x...
WordPress Plugin Hybrid Composer 1.4.6 - Improper Access Restrictions
WordPress Plugin Hybrid Composer 1.4.6 - Improper Access Restrictions Exploit Title: Wordpress Hybrid Composer = 1.4.6 - Unauthenticated Configuration Access Admin Takeover Date: 2019-07-24 Vendor Homepage: http://wordpress.framework-y.com Software Link:...
CVE-2019-12328
CVE-2019-12328 affects the ATCOM A10W VoIP phone (firmware 2.6.1a2421). The web interface’s remote phonebook configuration URI is vulnerable to command injection via shell metacharacters in a POST request, enabling an authenticated remote attacker on the same network to trigger OS commands. Affec...
CVE-2019-12328
A command injection missing input validation issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware 2.6.1a2421 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request...
CVE-2019-12324
A command injection missing input validation issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters i...
Command injection
A command injection missing input validation issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters i...
CVE-2019-12324
A command injection missing input validation issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters i...
PT-2019-12753
Name of the Vulnerable Software and Affected Versions Akuvox R50P VoIP phone version 50.0.6.156 Description A command injection issue due to missing input validation in the IP address field for the logging server in the configuration web interface allows an authenticated remote attacker in the sa...
PT-2019-12757
Name of the Vulnerable Software and Affected Versions Atcom A10W VoIP phone version 2.6.1a2421 Description A command injection issue due to missing input validation exists in the remote phonebook configuration URI of the web interface. This allows an authenticated remote attacker in the same...
CVE-2019-12324: Improper Neutralization of Special Elements used in an OS Command
A command injection missing input validation issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters i...
CVE-2019-12328: Improper Neutralization of Special Elements used in an OS Command
A command injection missing input validation issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware 2.6.1a2421 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request...
Sql injection
Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1...
CVE-2019-1010248
Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1...
PT-2019-11527
Name of the Vulnerable Software and Affected Versions: Synetics GmbH I-doit versions prior to 1.12.1 Description: The issue allows for unauthenticated MySQL database access. It is related to the web login form component. An attacker can exploit this by sending a malicious HTTP POST request to the...
CVE-2019-1010248: Improper Neutralization of Special Elements used in an SQL Command
Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1...
Kartpay: Reflected XSS on https://merchant.kartpay.com/payment_settings [status]
Vulnerable URL https://merchant.kartpay.com/paymentsettings/type Parameter status Payload " Steps to Reproduce 1. Login with your credentials. 2. Go to https://merchant.kartpay.com/paymentsettings 3. Start Burp suite proxy and intercept on. 4. Click on Run and Save button. intercept the request. ...