4744 matches found
CVE-2020-11518
Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution...
CVE-2020-11456
LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php aka survey groups...
CVE-2020-7126
A remote server-side request forgery ssrf vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...
CVE-2020-17457
Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An authenticated attacker can store an XSS payload in the PSCUFILEINIT field of a Save Configuration XML document. The payload is triggered in the HTTP error response pages...
CVE-2020-14435
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5.2.104, SRS60 before 2.5.2.104, SRR60 before 2.5.2.104, SRK60B03 before 2.5.2.104, SRK60B04 before 2.5.2.104, SRK60B05 before 2.5.2.104, and SRK60B06 before 2.5.2.104...
CVE-2010-3012
Cross-site scripting XSS vulnerability in HP System Management Homepage SMH before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this issue was originally assigned CVE-2010-3010 due to a CNA error...
CVE-2019-18357
An XSS issue was discovered in Thycotic Secret Server before 10.7 issue 2 of 2...
CVE-2019-13564
XSS exists in Ping Identity Agentless Integration Kit before 1.5...
CVE-2019-17220
Rocket.Chat before 2.1.0 allows XSS via a URL on a !title line...
CVE-2019-14793
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmbdeletefile attachmentid parameter...
CVE-2019-9087
HotelDruid before v2.3.1 has SQL Injection via the /tabtariffe.php numtariffa1 parameter...
CVE-2019-19016
An issue was discovered in TitanHQ WebTitan before 5.18. Some functions, such as /history-x.php, of the administration interface are vulnerable to SQL Injection through the results parameter. This could be used by an attacker to extract sensitive information from the appliance database...
CVE-2019-20647
NETGEAR RAX40 devices before 1.0.3.64 are affected by denial of service...
CVE-2019-15650
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes such as disabling unattended theme updates because of a nonce check error...
CVE-2018-8728
server/app/views/static/code.html in Kontena before 1.5.0 allows XSS in "kontena master login --remote" code display, as demonstrated by /codecode= in a URI...
CVE-2017-18489
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS...
CVE-2015-7344
HikaShop Joomla Component before 2.6.0 has XSS via an injected payload/caption...
CVE-2018-20978
The wp-all-import plugin before 3.4.7 for WordPress has XSS...
CVE-2015-9466
The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTPCLIENTIP, HTTPXFORWARDEDFOR, HTTPXFORWARDED, HTTPFORWARDEDFOR, or HTTPFORWARDED variable...