CVE-2018-10267

WTCMS 1.0 is affected by a CSRF vulnerability that allows an attacker to add an administrator account using the URI index.php?admin&m=user&a=add_post. Root cause: CSRF in the admin-user creation flow. Impact: attacker could elevate privileges by creating an admin account; no exploitation details ...

CVE-2018-10265

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

PT-2018-9797 · Wtcms · Wtcms

Name of the Vulnerable Software and Affected Versions: WTCMS version 1.0 Description: The issue allows for the addition of an administrator account due to a CSRF vulnerability. This can be exploited via the "index.php?admin&m=user&a=add post" URI. Recommendations: For WTCMS version 1.0, as a...

jira2.salt-solutions.de XSS vulnerability

Open Bug Bounty ID: OBB-604416 Description| Value ---|--- Affected Website:| jira2.salt-solutions.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-1167

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-1167

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-1167

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Huawei Multiple Product ENUM Module Buffer Overflow Vulnerability

DP300, RP200, TE30, etc. are network video communication devices from Huawei China. A buffer overflow vulnerability exists in the ENUM Electronic Numbers to URI Mapping module of several Huawei products. A remote attacker could send a carefully constructed ENUM message to the affected device by...

Microsoft Skype URL Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Skype. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Cross site request forgery (csrf)

iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...

CVE-2018-10136

iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...

CVE-2018-10137

iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...

CVE-2018-10136

iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...

state.rin.ru XSS vulnerability

Open Bug Bounty ID: OBB-602863 Description| Value ---|--- Affected Website:| state.rin.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-10118

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...

Moxa EDR-810 Web Server strcmp Multiple Denial of Service Vulnerabilities(CVE-2017-14435 - CVE-2017-14437)

Summary An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXALOG.ini, /MOXACFG.ini, o...

CVE-2018-10118

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...

CVE-2018-10118

Monstra CMS 3.0.4 is affected by a Stored XSS in the Name field on the Create New Page screen (admin/index.php?id=pages), related to plugins/box/pages/pages.admin.php. This CVE details the vulnerable component path and the input point that leads to script execution. The connected data confirms th...

CVE-2018-10082

CMS Made Simple CMSMS through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or...