13584 matches found
Information disclosure
Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp URI...
CVE-2018-12923
CVE-2018-12923 : The BWS Systems HA-Bridge devices are vulnerable to an information-disclosure issue where a remote attacker can obtain sensitive information by issuing a direct request to the #!/system URI. The available documents identify this as a vulnerability in the HA-Bridge, describing the...
CVE-2018-12922
Emerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control via the config/configUser.htm or config/configTelnet.htm URI...
CVE-2018-12921
Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the meterinformation.htm, diagsystem.htm, or diagdnplanwan.htm URI...
CVE-2018-12920
The CVE-2018-12920 entry concerns Brickstream 2300 devices. Affected component: the device’s HTTP endpoints exposed via the URIs basic.html#ipsettings and basic.html#datadelivery. Root cause: information disclosure allowing remote attackers to obtain potentially sensitive information by directly ...
PT-2018-11478
Name of the Vulnerable Software and Affected Versions Brickstream 2300 affected versions not specified Description The issue allows remote attackers to obtain potentially sensitive information by making a direct request for specific URI endpoints, such as "basic.htmlipsettings" or...
CVE-2018-12914
A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI...
Sql injection
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...
CVE-2018-12912
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...
CVE-2018-12914
A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI...
Information disclosure
SAJ Solar Inverter allows remote attackers to obtain potentially sensitive information via a direct request for the inverterinfo.htm or englishmain.htm URI...
Cross site scripting
Reflected Cross-Site Scripting XSS exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI...
Cross site scripting
Reflected Cross-Site Scripting XSS exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loanrules.php?keywords= URI, a related issue to CVE-2017-7242...
CVE-2018-12655
Reflected Cross-Site Scripting XSS exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loanrules.php?keywords= URI, a related issue to CVE-2017-7242...
CVE-2018-12656
Reflected Cross-Site Scripting XSS exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI...
CVE-2018-12655
Reflected Cross-Site Scripting XSS exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loanrules.php?keywords= URI, a related issue to CVE-2017-7242...
CVE-2018-12635
CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...
CVE-2018-12655: Improper Neutralization of Input During Web Page Generation
Reflected Cross-Site Scripting XSS exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loanrules.php?keywords= URI, a related issue to CVE-2017-7242...
CVE-2018-12654: Improper Neutralization of Input During Web Page Generation
Reflected Cross-Site Scripting XSS exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bibliography/index.php?keywords= URI...