13584 matches found
Cross site request forgery (csrf)
iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...
CVE-2018-10136
iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...
CVE-2018-10136
iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...
CVE-2018-10137
iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...
state.rin.ru XSS vulnerability
Open Bug Bounty ID: OBB-602863 Description| Value ---|--- Affected Website:| state.rin.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-10118
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...
Moxa EDR-810 Web Server strcmp Multiple Denial of Service Vulnerabilities(CVE-2017-14435 - CVE-2017-14437)
Summary An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXALOG.ini, /MOXACFG.ini, o...
CVE-2018-10118
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...
CVE-2018-10118
Monstra CMS 3.0.4 is affected by a Stored XSS in the Name field on the Create New Page screen (admin/index.php?id=pages), related to plugins/box/pages/pages.admin.php. This CVE details the vulnerable component path and the input point that leads to script execution. The connected data confirms th...
CVE-2018-10082
CMS Made Simple CMSMS through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or...
Moxa EDR-810 Web Server URI Denial of Service Vulnerability
Summary An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in the web server crashing. An attacker can send a crafted URI to trigger this...
UBUNTU-CVE-2018-10060
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php...
DEBIAN-CVE-2018-10060
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php...
PT-2018-9649
Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.1.37 Description: The issue arises from the software's failure to properly reject unintended characters, which is related to the use of the sanitize uri function in lib/functions.php. This can lead to a cross-site...
Joyplus CMS Information Disclosure Vulnerability
Joyplus CMS is an efficient video movie website management system built with PHPmysql, independently developed by Zhi Jing Technology, which has been used as a backend management system for free products Joyplus Video, and after continuous improvement, it now has a complete functional system and...
Information disclosure
joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI...
CVE-2018-10028
joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI...
Spotify Music Player URI parsing Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
PT-2018-10739
Name of the Vulnerable Software and Affected Versions Spotify Music Player version 1.0.69.336 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file...