2942 matches found
CVE-2019-8432
In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter...
CVE-2019-8432
In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter...
CVE-2019-8432
CmsEasy 7.0 is affected by a cross-site scripting (XSS) vulnerability in the ckplayer.php URL parameter. The issue is documented across multiple sources (NVD, Red Hat, CVE lists) as an XSS in CmsEasy 7.0 via ckplayer.php, but no further technical specifics (such as exact code path, exploit detail...
CVE-2018-15657
An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter...
PT-2019-16767 · Labkey · Labkey Server Community Edition
Name of the Vulnerable Software and Affected Versions: LabKey Server Community Edition versions prior to 18.3.0-61806.763 Description: The issue is related to an open redirect vulnerability. It affects the / r1/ API endpoint, specifically the returnURL parameter, allowing an unauthenticated remot...
NEC Aterm W300P Buffer Overflow Vulnerability
The NEC Aterm W300P is a wireless router from Nippon Electric NEC. A buffer overflow vulnerability exists in the NEC Aterm W300P using firmware version 1.0.13 and earlier, which can be exploited by an attacker to execute arbitrary code with the help of the 'submit-url' parameter...
Buffer overflow
Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter...
Design/Logic Flaw
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode parameter of a certain URL...
CVE-2018-18004
Incorrect Access Control in modinetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable arbitrary system services via a URL parameter...
SugarCRM (ConnectorsController) Server-Side Request Forgery Vulnerability
SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A server-side...
CVE-2018-20486
MetInfo 6.x through 6.1.3 has XSS via the /admin/login/logincheck.php urlarray parameter...
CVE-2018-20171
An issue was discovered in Nagios XI before 5.5.8. The url parameter of rssdashlet/magpierss/scripts/magpiesimple.php is not filtered, resulting in an XSS vulnerability...
CVE-2018-20172
An issue was discovered in Nagios XI before 5.5.8. The rssurl parameter of rssdashlet/magpierss/scripts/magpieslashbox.php is not filtered, resulting in an XSS vulnerability...
CVE-2018-20171
Summary of CVE-2018-20171 (Nagios XI): Nagios XI builds prior to 5.5.8 are affected by an XSS vulnerability in the url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php where the parameter is not filtered. This can allow a user-assisted or external attacker to inject script in contexts...
CVE-2018-19922
Persistent Cross-Site Scripting XSS in the advancedsetupwebsiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTML into the Website Blocking page by inserting arbitrary HTML into the 'TodUrlAdd...
Command injection
OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secretkey" URL parameter...
Directory traversal
Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter. NOTE: the "filename" POST parameter is covered by CVE-2018-11345...
Directory traversal
Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar issue to CVE-2018-11344...