CVE-2019-0327

SAP NetWeaver for Java Application Server - Web Container, engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5, servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5, allows an attacker to upload files including script files without proper file format validation...

CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

Cross site scripting

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

CVE-2019-13146

CVE-2019-13146 concerns the field_test gem (Ruby) 0.3.0, where unvalidated input allows a method to return arbitrary inputs. The root cause is acceptance of arbitrary variants from user-supplied input, enabling potential SQL injection or XSS when trusted values are used. Multiple connected source...

CVE-2018-15738

An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the output buffer address value from IOCtl 0x8000205F...

MiniCMS mc-admin/page-edit.php file cross-site scripting vulnerability

MiniCMS is a content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in the mc-admin/page-edit.php file in MiniCMS version 1.10. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can...

CVE-2019-13146: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

Wikindx Cross-Site Scripting Vulnerability

Wikindx is a suite of virtual research environments online bibliography and quote/notes management and article creation system. A cross-site scripting vulnerability exists in the noMenu and noSubMenu in the core/navigation/MENU.php file in WIKINDX versions prior to 5.8.1. The vulnerability stems...

PT-2019-13154

Name of the Vulnerable Software and Affected Versions field test gem version 0.3.0 Description The issue concerns unvalidated input in a method call, which can return any input, potentially leading to various vulnerabilities such as SQL injection or cross-site scripting XSS if applications treat...

Foxit PhantomPDF Button Calculate Remote Code Execution Vulnerability

Foxit PhantomPDF is a multifunctional PDF editor. A remote code execution vulnerability exists in the handling of Calculate operations in Foxit PhantomPDF 9.5.0.20723 and earlier versions. The vulnerability stems from a failure to validate the existence of an object before performing an operation...

MiniCMS Cross-Site Scripting Vulnerability (CNVD-2019-21430)

MiniCMS is a content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in the mc-admin/post-edit.php file in MiniCMS version 1.10, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this...

Template Injection

fieldtest is vulnerable to template injection. Unvalidated input allows an attacker to pass arbitrary variants via query parameters. This can potentially lead to cross-site scripting vulnerabilities or SQL injection...

Synology Calendar Cross-Site Scripting Vulnerability (CNVD-2019-20976)

Synology Calendar is a file protection program from Synology Inc. of Taiwan, China that runs on Synology NAS Network Storage Server devices. A cross-site scripting vulnerability exists in Event Editor in Synology Calendar versions prior to 2.3.0-0615. The vulnerability stems from a lack of proper...

Arbitrary Variants Via Query Parameters

Due to unvalidated input, an attacker can pass in arbitrary variants via query parameters. If an application treats variants as trusted, this can lead to potential vulnerabilities like SQL injection or cross-site scripting XSS. For instance: landingpage = fieldtest:landingpage Page.where"key =...

CVE-2019-10989

In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution. Note: A different vulnerability than CVE-2019-1099...

SeedDMS versions < 5.1.11 - Remote Command Execution Exploit

Exploit for php platform in category web applications Exploit Title: Remote Command Execution through Unvalidated File Upload in SeedDMS versions "; $cmd = $REQUEST'cmd'; system$cmd; echo ""; die; ? Step 3: Now after uploading the file check the document id corresponding to the document. Step 4:...