10022 matches found
CVE-2017-16251
The CVE-2017-16251 entry concerns Mitel ST’s conferencing component (GA28 and earlier). A vulnerability exists where an authenticated user can upload a malicious script to the Personal Library via a crafted POST request, potentially allowing arbitrary code execution within the application context...
PYSEC-2018-110
Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appear to be exploitable via An attacker can freeze te server by sending a giant string to the ID parameter...
Input validation
Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appear to be exploitable via An attacker can freeze te server by sending a giant string to the ID parameter...
CVE-2018-1000081
Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appear to be exploitable via An attacker can freeze te server by sending a giant string to the ID parameter...
CVE-2018-1000081
Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appear to be exploitable via An attacker can freeze te server by sending a giant string to the ID parameter...
PT-2018-6262
Name of the Vulnerable Software and Affected Versions: Mitel ST 14.2, release GA28 and earlier Description: A vulnerability in the conferencing component could allow an authenticated user to upload a malicious script to the Personal Library by a crafted POST request to an unspecified API endpoint...
PT-2018-9260
Name of the Vulnerable Software and Affected Versions: Ajenti version 2 Description: The issue is related to an Input Validation vulnerability in the ID string on Get-values POST request, which can cause Server Crashing. An attacker can exploit this by sending a large string to the ID parameter,...
Category Order and Taxonomy Terms Order <= 1.5.2.2 - Authenticated PHP Object Injection
Usage of unserialize on user input in the saving request of the orders leads to PHP object injection vulnerability. PoC Send POST request to "URL/wp-admin/admin-ajax.php" with parameters "action=update-taxonomy-order=SERIALIZED-OBJECT"...
Category Order and Taxonomy Terms Order <= 1.5.2.2 - Authenticated PHP Object Injection
Usage of unserialize on user input in the saving request of the orders leads to PHP object injection vulnerability. Send POST request to "URL/wp-admin/admin-ajax.php" with parameters "action=update-taxonomy-order&order=SERIALIZED-OBJECT"...
Fedora 26 : sblim-sfcb (2018-4367d984c1)
Fix NULL pointer DoS vulnerability via POST request to /cimom CVE-2018-6644 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...
CVE-2017-18195: Undefined Security Weakness
An issue was discovered in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers...
Custom Permalinks <= 1.1 - Authenticated SQL Injection
Missing checking of user controllable input during Bulk Action in the Custom Permalinks backend page leads to SQL injection vulnerability. Send authenticated POST request to "URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks" with parameters "action=delete&permalinks=1 PAYLOAD -- "...
The vulnerability of the web interface of the Sonia (/user/bin/sonia) application, a micro-programmed software for Dahua IP cameras, allows a intruder to trigger a service failure or execute arbitrary code.
The vulnerability of the web interface of the Sonia /user/bin/sonia application, a microprogramming-based IP camera from Dahua, arises due to operations that go beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure operations beyond memory...
userSpice 4.3 - Cross-Site Scripting
Application UserSpice PHP user management Vulnerability userSpice alert"1"&csrf=8b1339546d6af1e7536da0a705302e9c&updatebio= Vulnerable code: id?" class="nounderline"id?...
LogicalDOC Enterprise 7.7.4 - User Enumeration
LogicalDOC Enterprise 7.7.4 - User Enumeration LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document management...
CVE-2018-6644
A NULL pointer dereference flaw was found in the way sblim-sfcb handled processing of POST requests to the /cimom URI. A remote attacker could use this flaw to cause a sblim-sfcb child process to crash via a specially crafted HTTP POST request...
CVE-2018-6644
SBLIM Small Footprint CIM Broker SFCB 1.4.9 has a null pointer DoS vulnerability via a crafted POST request to the /cimom URI...
CVE-2018-6644
SBLIM Small Footprint CIM Broker SFCB 1.4.9 has a null pointer DoS vulnerability via a crafted POST request to the /cimom URI...
