Command injection

SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service...

CVE-2023-48376 SmartStar Software CWS Web-Base - Arbitrary File Upload

SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service...

CVE-2023-48375

CVE-2023-48375 concerns SmartStar Software CWS, a web-based integration platform. The entry describes a broken access control issue: an authenticated user with normal privileges can obtain administrator privileges and perform arbitrary system operations or disrupt services. Affected component is ...

Web-Based Student Clearance System SQL Injection Vulnerability

Web-Based Student Clearance System is a web-based student clearance system. A SQL injection vulnerability exists in Web-Based Student Clearance System version 1.0, which originates from the lack of validation of externally entered SQL statements in the parameter Student in /libsystem/login.php. A...

Siemens SINEC INS Denial of Service Vulnerability

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. A denial of service vulnerability exists in Siemens SINEC INS, whic...

Siemens SINEC INS Denial of Service Vulnerability (CNVD-2023-97253)

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. A denial of service vulnerability exists in Siemens SINEC INS, whic...

CVE-2023-6659

A vulnerability, which was classified as critical, has been found in Campcodes Web-Based Student Clearance System 1.0. This issue affects some unknown processing of the file /libsystem/login.php. The manipulation of the argument student leads to sql injection. The attack may be initiated remotely...

CVE-2023-6659

CVE-2023-6659 affects Campcodes Web-Based Student Clearance System 1.0, specifically the /libsystem/login.php handler. The vulnerability arises from improper handling of the student parameter, leading to SQL injection. Impact is described as remote exploitation with potential data exposure; explo...

CVE-2023-6659: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, has been found in Campcodes Web-Based Student Clearance System 1.0. This issue affects some unknown processing of the file /libsystem/login.php. The manipulation of the argument student leads to sql injection. The attack may be initiated remotely...

Afian FileRun security vulnerability

Afian FileRun is a full-featured web-based file manager. A security vulnerability exists in Afian FileRun that stems from a stored cross-site scripting vulnerability that allows an attacker to inject JavaScript code that executes when a user clicks on a carefully crafted shared link...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CNVD-2023-93326)

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. The Cisco Identity Services Engine suffers from...

Cisco IP Phone Cross-Site Scripting Vulnerability

Cisco IP Phone is a hardware device from the American company Cisco Cisco. IP Phone that provides calling capabilities. Cisco IP Phones suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the web-based management...

The vulnerability of the PUB Manager web-based system for managing technological processes in SIMATIC PCS neo lies in the lack of protective measures for the SQL query structure. This allows attackers to execute arbitrary SQL queries against the database.

The vulnerability of the PUB Manager web-based system for managing technological processes in SIMATIC PCS neo relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the database...

Cross site scripting

A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation ...

Input validation

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application. This vulnerability is due to insufficient file input validation. An attacker could exploit this...

CVE-2023-20272

Cisco Identity Services Engine (ISE) is affected by an arbitrary file write vulnerability in its web-based management interface. The issue stems from insufficient file input validation, allowing an authenticated, remote attacker to upload a malicious file to the web root and potentially replace f...

CVE-2023-20208

Cisco ISE web-based management interface is affected by a cross-site scripting (XSS) vulnerability (CVE-2023-20208) that can be exploited by an authenticated, remote attacker with high privileges to perform an XSS against users. The issue stems from insufficient input validation/escaping of user-...

CVE-2023-20208

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an affected device...

CVE-2023-20265

CVE-2023-20265 is a stored XSS vulnerability in the web-based management interface of a subset of Cisco IP Phones. Root cause: insufficient validation of user-supplied input; an authenticated, remote attacker needs valid credentials to lure a user into viewing a page containing malicious HTML/scr...

CVE-2023-20265

A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation ...