CVE-2018-20607

CVE-2018-20607 describes an information-disclosure vulnerability in imcat 4.4 , where remote attackers can obtain potentially sensitive debugging information via the URI root/tools/adbug/binfo.php . The connected documents consistently identify this URI as the disclosure point, indicating a parti...

CVE-2018-20609

CVE-2018-20609 affects imcat 4.4. The vulnerability is an information disclosure: remote attackers can obtain potentially sensitive configuration information through the root/tools/adbug/check.php URI. Connected sources corroborate this description across multiple repositories (NVD, Red Hat, CNVD...

CVE-2018-20609

imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/check.php URI...

Nextcloud: Content spoofing on https://surveyserver.nextcloud.com

Hi NextCloud team, the https://surveyserver.nextcloud.com domain is vulnerable against content spoofing in the forbidden page due to the fact that the request URI is reflected without validation inside the aforementioned page. 1. Go on...

Design/Logic Flaw

Orange Livebox 00.96.320S devices have an undocumented /systemfirmwarel.stm URI for manual firmware update. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T VR9 1.2...

CVE-2018-16637

Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI...

CVE-2018-20575

Orange Livebox 00.96.320S devices have an undocumented /systemfirmwarel.stm URI for manual firmware update. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T VR9 1.2...

CVE-2018-16637: Improper Neutralization of Input During Web Page Generation

Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI...

PT-2018-13664

Name of the Vulnerable Software and Affected Versions Evolution CMS versions 1.4.0 through 1.4.5 Description The issue allows for XSS via the page weblink title parameter to the "manager/" URI. This can be exploited to execute malicious scripts. Recommendations For Evolution CMS versions 1.4.0...

Information disclosure

NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=&GOTO8 URIs...

CVE-2018-11741

NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=&GOTO8 URIs...

Design/Logic Flaw

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a % string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext userna...

CVE-2018-20465

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a % string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext userna...

CVE-2018-20465

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a % string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext userna...

CVE-2018-20448

Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI...

Design/Logic Flaw

Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI...

CVE-2018-20371

PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.htmlpasswd1" and "GET /login.htmlpasswd2" and so on...

Default credentials

PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.htmlpasswd1" and "GET /login.htmlpasswd2" and so on...

CVE-2018-20371

PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.htmlpasswd1" and "GET /login.htmlpasswd2" and so on...

CVE-2018-20371: Exposure of Sensitive Information to an Unauthorized Actor

PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.htmlpasswd1" and "GET /login.htmlpasswd2" and so on...