gnuboard5 跨站脚本漏洞

GNUBOARD5 is a Web forum system based on PHP and MySQL. A cross-site scripting vulnerability exists in GNUBOARD5 5.3.2.8 and earlier versions. The vulnerability can be exploited to conduct cross-site scripting attacks via the act parameter in bbs/moveupdate.php...

CVE-2011-3611

A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12...

CVE-2011-3611

A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12...

CVE-2011-3611: Improper Input Validation

A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12...

CVE-2018-15678

An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...

CVE-2018-15678: Improper Neutralization of Input During Web Page Generation

An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...

CVE-2018-11346: Direct Request

An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "downloadsyssettings" action and then specify files arbitrarily throughout the system via the act parameter...

ASUSTOR AS6202T ADM Insecure Direct Object Reference Vulnerability

ADM ASUSTOR Data Manager is the operating system and user interface for ASUSTOR NAS. An insecure direct object reference vulnerability exists in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3. An attacker could use this vulnerability to reference the "downloadsyssettings" action to arbitrarily...

PT-2018-10504

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description The issue allows for an insecure direct object reference, enabling access to arbitrary files throughout the system. This is achieved by referencing the "download sys settings" action and...

CVE-2017-1002025: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passing it into an SQL statement...

CVE-2015-8352: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter to ajax.php...

CVE-2014-4596: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in js/button-snapapp.php in the SnapApp plugin 1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 msg or 2 act parameter...

HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow

No description provided by source. $Id: hpnnmsnmpvieweractapp.rb 12098 2011-03-23 15:47:20Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...

WWWThreads Cross Site Scripting

www.eVuln.com advisory: XSS vulnerability in WWWThreads php version Summary: http://evuln.com/vulns/155/summary.html Details: http://evuln.com/vulns/155/description.html -----------Summary----------- eVuln ID: EV0155 Software: n/a Vendor: WWWThreads Version: 2006.11.25 Critical Level: low Type:...

CVE-2010-1552: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the doLoad function in snmpviewer.exe in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via the act and app parameters...

CVE-2007-6552

Directory traversal vulnerability in index.php in AuraCMS 2.2 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the act parameter, possibly involving the news pilih component; as demonstrated by including admin/adminusers.php to bypass a protection...

CVE-2007-3611: Undefined Security Weakness

admin.php in VRNews 1.1.1, and possibly other 1.x versions, does not require authentication, which allows remote attackers to perform certain administrative actions via a direct request with a 1 edit, 2 add, 3 config, or 4 del value in the act parameter...

CVE-2007-1152

Multiple directory traversal vulnerabilities in Pyrophobia 2.1.3.1 allow remote attackers to read arbitrary files via a .. dot dot in the 1 act or 2 pid parameter to the top-level URI index.php, or the 3 action parameter to admin/index.php. NOTE: some of these details are obtained from third part...

CVE-2006-6284

Directory traversal vulnerability in admin.php in Vikingboard 0.1.2 allows remote authenticated administrators to include arbitrary files via a .. dot dot sequence in the act parameter...

PT-2006-2101 · Simplog · Simplog

Name of the Vulnerable Software and Affected Versions: Simplog versions 1.0.2 and earlier Description: A directory traversal issue exists, allowing remote attackers to include or read arbitrary .txt files. This is achieved via the act and blogid parameters in the index.php file. Recommendations:...