CVE-2019-5121

SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter uuid in /objects/pluginSwitch.json.php...

CVE-2019-5114

An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

Sql injection

Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

Sql injection

An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

Sql injection

Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json.php...

Sql injection

An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause a SQL injection. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

CVE-2019-5123

Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json.php...

CVE-2019-5123

The CVE-2019-5123 issue affects YouPHPTube 7.6 and involves SQL injection via the /objects/pluginSwitch.json.php endpoint (parameter dir). The TALOS advisory confirms authenticated SQL injections in the YouPHPTube 7.6 frontend/plugin switch logic, potentially allowing exfiltration of database dat...

CVE-2019-5122

SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter name in /objects/pluginSwitch.json.php...

CVE-2019-5117

Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

PT-2019-15271 · Wago · Wago Series Pfc200 +1

Name of the Vulnerable Software and Affected Versions: WAGO Series PFC100 and PFC200 devices versions prior to FW12 Description: The issue allows for Information Disclosure due to improper access control. A remote attacker can exploit this by sending crafted HTTP requests to check for the existen...

YouPHPTube /objects/commentAddNew.json.php comments_id SQL injection vulnerability

Summary An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowin...

CVE-2019-14656

Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account with a password of user can make admin requests via HTTP...

Microsoft Office SharePoint XSS Vulnerability

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

Microsoft IIS Server Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it. An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT...

CVE-2019-11651

Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web reques...

Cross site scripting

Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web reques...

VulnCheck KEV: CVE-2018-13379

Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests...

ACTi ACM-5611 Camera Remote Command Execution Vulnerability

The ACTi ACM-5611 is a network camera manufactured by ACTI. A remote command execution vulnerability exists in the ACTi ACM-5611 Camera. The vulnerability stems from the program not properly validating user-submitted data. A remote attacker can exploit this vulnerability by sending a malicious HT...

The vulnerability of the Segment component in Oracle Retail Customer Engagement software allows a hacker to gain read access to data or cause a partial service disruption.

The vulnerability of the Segment component in Oracle Retail Customer Engagement software relates to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain read-only access to data or cause partial service disruption by sending specially crafted HTTP requests...