10682 matches found
CVE-2018-12973
OpenTSDB 2.3.0 is affected by a Cross-site Scripting (XSS) vulnerability in the json parameter of the /q URI. The issue, described across multiple sources (OpenTSDB advisories and CVE references), indicates that unsanitary input in the json parameter can lead to script injection. The available co...
CVE-2018-12973
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI...
CVE-2018-12971
EasyCMS 1.3 is affected by a CSRF vulnerability that allows deleting users via the index.php?s=/admin/user/delAll URI. Multiple sources (NVD/NVD-derived entries, CVE lists, CNVD) corroborate that this is a CSRF flaw targeting the admin user deletion endpoint. The exact impact is deletion of users...
CVE-2018-12972
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...
The vulnerability of Adobe Dreamweaver CC arises from incorrect processing of URIs, allowing attackers to execute arbitrary code in the context of the current user.
The vulnerability of Adobe Dreamweaver CC is related to the lack of measures taken to neutralize special elements used in operating system teams. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...
Information disclosure
Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the meterinformation.htm, diagsystem.htm, or diagdnplanwan.htm URI...
Information disclosure
Northern Electric & Power NEP inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/index/1 URI...
CVE-2018-12927
Northern Electric & Power NEP inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/index/1 URI...
Design/Logic Flaw
Emerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control via the config/configUser.htm or config/configTelnet.htm URI...
CVE-2018-12926
Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp URI...
Information disclosure
Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp URI...
CVE-2018-12921
Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the meterinformation.htm, diagsystem.htm, or diagdnplanwan.htm URI...
CVE-2018-12923
CVE-2018-12923 : The BWS Systems HA-Bridge devices are vulnerable to an information-disclosure issue where a remote attacker can obtain sensitive information by issuing a direct request to the #!/system URI. The available documents identify this as a vulnerability in the HA-Bridge, describing the...
CVE-2018-12922
Emerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control via the config/configUser.htm or config/configTelnet.htm URI...
CVE-2018-12920
The CVE-2018-12920 entry concerns Brickstream 2300 devices. Affected component: the device’s HTTP endpoints exposed via the URIs basic.html#ipsettings and basic.html#datadelivery. Root cause: information disclosure allowing remote attackers to obtain potentially sensitive information by directly ...
CVE-2018-12914
A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI...
Sql injection
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...
CVE-2018-12912
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...
CVE-2018-12914
A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI...