10682 matches found
BWS Systems HA-Bridge Device Information Disclosure Vulnerability
BWS Systems HA-Bridge devices are a product for automating the connection and control of IoT devices. A security vulnerability exists in the BWS Systems HA-Bridge devices. A remote attacker could exploit this vulnerability by sending a direct request to the ! /system URI to obtain sensitive...
CVE-2018-13040
OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...
Cross site scripting
OpenSID 18.06-pasca has reflected Cross Site Scripting XSS via the cari parameter, aka an index.php/first?cari= URI...
Cross site request forgery (csrf)
OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...
Cross site request forgery (csrf)
ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/plweb.cgi/utilconfigloginact URI...
CVE-2018-13032
ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/plweb.cgi/utilconfigloginact URI...
CVE-2018-13032
ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/plweb.cgi/utilconfigloginact URI...
CVE-2018-7475
IceWarp Mail Server 12.0.3 is affected by a cross-site scripting (XSS) vulnerability in the webdav/ticket/ URIs. The issue, described in CVE-2018-7475, allows remote attackers to inject arbitrary web script or HTML. Public references confirm XSS in IceWarp Mail Server
CVE-2018-13010
WSTMall v1.9.1170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account...
CVE-2018-13003
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI...
Design/Logic Flaw
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI...
CVE-2018-13003
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI...
Mail.ru: Чтение системных данных приложения: данные для авторизации, логи, БД, личная переписка
Insufficient case sensitive filtering in intent URI could allow local malicious application to access local files via ICQ for Android...
Improper access control
Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...
CVE-2018-12972
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...
CVE-2018-12972
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...
Design/Logic Flaw
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI...
CVE-2018-12988
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...