Cisco Adaptive Security Appliance Software License Issue Vulnerability

Cisco Adaptive Security Appliances Software ASA Software is a set of firewalls and network security platforms from the U.S. company Cisco Cisco. The platform provides highly secure access to data and network resources and other features. An authorization issue vulnerability exists in Cisco ASA...

Synetics i-doit SQL Injection Vulnerability

Synetics i-doit is a set of open source configuration management database CMDB software from Synetics Germany. The software includes features such as IT infrastructure management, network document management, IP address management and IT asset management. A SQL injection vulnerability exists in t...

CVE-2019-1010248

Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1...

CVE-2019-1010248

Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1...

Sql injection

Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1...

CVE-2019-1010248

Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1...

CVE-2019-1010248

CVE-2019-1010248 affects Synetics i-doit 1.12 and earlier. A SQL injection in the Web login form allows an attacker to perform unauthenticated access to the MySQL database. The vulnerability is exploitable by sending a malicious HTTP POST request. The fixed version is 1.12.1. Connected sources co...

CVE-2019-1010248: Improper Neutralization of Special Elements used in an SQL Command

Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1...

CVE-2019-1010287

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...

Cross site scripting

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...

CVE-2019-1010287

Timesheet Next Gen vulnerable to reflected XSS (CVE-2019-1010287) in login.php (lines 40 and 54) via a redirect parameter. Affected: Timesheet Next Gen versions 1.5.3 and earlier. Impact: attacker can cause arbitrary HTML/JavaScript execution when a user clicks a malicious URL. Affected vector: r...

CVE-2019-1010287

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...

CVE-2017-18373

The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username user3 and and a long password consisting of a...

CVE-2017-2748

A potential security vulnerability caused by the use of insecure http transactions during login has been identified with early versions of the Isaac Mizrahi Smartwatch mobile app. HP has no access to customer data as a result of this issue...

Exploit for Improper Input Validation in Drupal

CVE-2018-7600 | Drupal 8.5.x --verbose --authentication...

Zhejiang Dahua Network Hard Disk Recorder DH-NVR2104HS-S1 has logical design loopholes

Zhejiang Dahua Network DVR DH-NVR2104HS-S1 is a network DVR that integrates 4-channel 10/100Mbps switch ports and supports 1080P HD real-time real-time preview and so on. A logical design vulnerability exists in the Zhejiang Dahua Network DVR DH-NVR2104HS-S1. An attacker can use the vulnerability...

Koozali Foundation SME Server Open Redirect Vulnerability Vulnerability

Koozali Foundation SME Server is a cross-platform, scalable Linux server from the Koozali Foundation. An open redirection vulnerability exists in the user web login function in Koozali Foundation SME Server versions 8.x, 9.x, and 10.x. The vulnerability can be exploited to gain unauthorized acces...

CVE-2017-8919

NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST API, which allows remote authenticated users to obtain sensitive password information via unspecified vectors...

CVE-2017-1000027: URL Redirection to Untrusted Site

Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function resulting in unauthorized account access...

Multiple Schneider Electric Modicon Products Vulnerable

Schneider-Electric Modicon M251 and others are programmable controller products of Schneider Electric France. A security vulnerability exists in several Schneider Electric Modicon products. The vulnerability can be exploited by an attacker to log into a web application by sniffing credentials...