100 matches found
CVE-2013-3586
Samsung Web Viewer for Samsung DVR devices allows remote attackers to bypass authentication via an arbitrary SessionID value in a cookie...
CVE-2025-1888
The Leica Web Viewer within the Aperio Eslide Manager Application is vulnerable to reflected cross-site scripting XSS. An authenticated user can access the slides within a project and injecting malicious JavaScript into the "memo" field. The memo field has a hover over action that will display a...
CVE-2025-1888: Improper Neutralization of Input During Web Page Generation
The Leica Web Viewer within the Aperio Eslide Manager Application is vulnerable to reflected cross-site scripting XSS. An authenticated user can access the slides within a project and injecting malicious JavaScript into the "memo" field. The memo field has a hover over action that will display a...
@ts3d-hoops/web-viewer (>=2026.5.0, <=2026.6.0), @ts3d-hoops/web-viewer-components (>=2026.5.0, <=2026.6.0) +5 more potentially affected by CVE-2025-25977 via canvg (4.0.1)
canvg NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on canvg and may be impacted: - @ts3d-hoops/web-viewer =2026.5.0, =2026.5.0, =2026.5.0, =2026.5.0, =0.1.3, =1.22.9-beta.0, =1.0.9, =3.0.9 Source cves: CVE-2025-25977 Source advisory:...
Hanwha Vision Web Viewer Cross-site Scripting (CVE-2018-11689)
Web Viewer for Hanwha DVR 2.17 and Smart Viewer in Samsung Web Viewer for Samsung DVR are vulnerable to XSS via the /cgi- bin/webviewerloginpage data3 parameter. The same Web Viewer codebase was transitioned from Samsung to Hanwha. This plugin only works with Tenable.ot. Please visit...
CVE-2024-29732
CVE-2024-29732 concerns the Abast SCAN_VISIO eDocument Suite Web Viewer. The vulnerability affects the login page through the user parameter, enabling an unauthenticated user to retrieve, update, and delete all database information via SQL injection. Reported impact is high/confidentiality, integ...
CVE-2024-29732 SQL Injection vulnerability on SCAN_VISIO eDocument Suite Web Viewer from Abast
A SQL Injection has been found on SCANVISIO eDocument Suite Web Viewer of Abast. This vulnerability allows an unauthenticated user to retrieve, update and delete all the information of database. This vulnerability was found on login page via "user" parameter...
CVE-2024-29732: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection has been found on SCANVISIO eDocument Suite Web Viewer of Abast. This vulnerability allows an unauthenticated user to retrieve, update and delete all the information of database. This vulnerability was found on login page via "user" parameter...
Abast SCAN_VISIO eDocument Suite Web Viewer 安全漏洞
Abast SCANVISIO eDocument Suite Web Viewer is a document viewer from Abast. A security vulnerability exists in Abast SCANVISIO eDocument Suite Web Viewer, which originates from an SQL injection vulnerability in the user parameter of the landing page. An unauthenticated attacker could use this...
CVE-2023-7238 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer
A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser...
Orthanc Osimis DICOM Web Viewer
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION : Exploitable remotely/low attack complexity Vendor : Orthanc Equipment : Osimis Web Viewer Vulnerability : Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary...
M-Files Hubshare 安全漏洞
M-Files Hubshare is a collaboration solution from M-Files, Inc. designed to seamlessly share files, documents and collaborative content. A security vulnerability exists in M-Files Hubshare versions prior to 3.3.11.3, which stems from poor access control in its PDFtron WebviewerUI allowing...
CVE-2022-30308
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...
CVE-2022-30309: Incorrect Authorization
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...
CVE-2022-30308: Incorrect Authorization
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...
CVE-2022-30309
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...
CVE-2021-32572
Speco Web Viewer through 2021-05-12 allows Directory Traversal via GET request for a URI with /.. at the beginning, as demonstrated by reading the /etc/passwd file...
CVE-2021-32572
Speco Web Viewer through 2021-05-12 allows Directory Traversal via GET request for a URI with /.. at the beginning, as demonstrated by reading the /etc/passwd file...
