199 matches found
Siemens SIPROTEC 5 代码问题漏洞
Siemens SIPROTEC 5 is a multifunction relay from Siemens, Germany. A code issue vulnerability exists in the Siemens SIPROTEC 5 that stems from a lack of proper validation of the http request parameters of the hosted web service, which can be exploited by an attacker to send specially crafted...
PT-2023-7478 · Unknown · Osprey Pump Controller
Name of the Vulnerable Software and Affected Versions: Osprey Pump Controller version 1.01 Description: The issue exists due to the failure to neutralize special elements in the DataLogView.php, EventsView.php, and AlarmsView.php scripts of the Osprey Pump Controller software. This allows a remot...
WordPress plugin Fastly 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
Changing Information Technology RAVA certificate validation system 代码问题漏洞
Changing Information Technology RAVA certificate validation system Panorama Software RAVA certificate validation system website is a certificate validation system from Changing Information Technology, China. A security vulnerability exists in the RAVA certificate validation system, which stems fr...
DEBIAN-CVE-2018-25047
In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smartyfunctionmailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user...
Teledyne FLIR AX8 操作系统命令注入漏洞
Teledyne FLIR AX8 is a series of thermal surveillance cameras from Teledyne FLIR USA. Teledyne FLIR AX8 1.46.16 and earlier versions suffer from an operating system command injection vulnerability that originates from an attacker being able to use root privileges to execute arbitrary commands on...
The vulnerability of the Passwork password manager lies in the improper restriction on the path name to the restricted catalog. This allows attackers to manipulate the URL parameters in order to gain access to local files and directories on the server.
The vulnerability of the Passwork password manager is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor, operating remotely, to manipulate URL parameters in order to gain access to local files and directories on th...
PT-2022-21073 · Totolink · Totolink T6
Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.9cu.5179 B20201015 Description: A stack overflow issue was discovered via the url parameter in the function FUN 00418540. This issue can be exploited, potentially leading to unintended consequences. Recommendations: Fo...
CVE-2022-33175
Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/getparam.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrator...
External Control of Assumed-Immutable Web Parameter in moodle
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field...
GHSA-X6GM-QQWP-76GR External Control of Assumed-Immutable Web Parameter in moodle
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field...
CVE-2022-29399
TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the url parameter in the function FUN00415bf0...
CVE-2022-27293
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanSetup. This vulnerability allows attackers to cause a Denial of Service DoS via the webpage parameter...
Cross site scripting
InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scripting XSS vulnerability via the webexec parameter at /apply.cgi...
D-Link DIR-619 缓冲区错误漏洞
D-Link DIR-619 is a series of routers from D-Link, a Chinese company. D-Link DIR-619 Ax v1.00 has a security vulnerability that can be exploited by attackers to cause a denial of service DoS via the webpage parameter...
Joomla! 代码注入漏洞
Joomla! is a set of forum components used in the Joomla! content management system. A code injection vulnerability exists in versions 4.0.0 to 4.1.0 of Joomla!, which stems from an HTTP request parameter input validation error. No detailed vulnerability details are available at this time...
Tp-link Archer C2 操作系统命令注入漏洞
TP-Link Archer C2 is a wireless router from Tp-link.TP-Link Archer C20i version 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n is vulnerable due to a security flaw in the device's HTTP parameter XTP ExternalIPv6Address. ExternalIPv6Address in the device lacks filtering and escaping of user data, which...
WordPress plugin Embed Swagger 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...
CVE-2021-34655
The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter found in the /inc/class.ajax.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.11...