13584 matches found
Improper access control
Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...
CVE-2018-12972
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...
CVE-2018-12972
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...
Design/Logic Flaw
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI...
CVE-2018-12988
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...
CVE-2018-12973
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI...
CVE-2018-12988
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...
CVE-2018-12972
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...
CVE-2018-12973
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI...
CVE-2018-12973
OpenTSDB 2.3.0 is affected by a Cross-site Scripting (XSS) vulnerability in the json parameter of the /q URI. The issue, described across multiple sources (OpenTSDB advisories and CVE references), indicates that unsanitary input in the json parameter can lead to script injection. The available co...
CVE-2018-12972
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...
CVE-2018-12971
EasyCMS 1.3 is affected by a CSRF vulnerability that allows deleting users via the index.php?s=/admin/user/delAll URI. Multiple sources (NVD/NVD-derived entries, CVE lists, CNVD) corroborate that this is a CSRF flaw targeting the admin user deletion endpoint. The exact impact is deletion of users...
Adobe Dreamweaver CC Code Execution
The vulnerability of Adobe Dreamweaver CC is related to the lack of measures taken to neutralize special elements used in operating system teams. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...
CVE-2018-12973: Improper Neutralization of Input During Web Page Generation
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI...
CVE-2018-12972: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...
Information disclosure
Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the meterinformation.htm, diagsystem.htm, or diagdnplanwan.htm URI...
CVE-2018-12927
Northern Electric & Power NEP inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/index/1 URI...
Information disclosure
Northern Electric & Power NEP inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/index/1 URI...