UBUNTU-CVE-2019-18345

A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...

CVE-2019-18345

A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...

CVE-2019-18345: Improper Neutralization of Input During Web Page Generation

A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...

PT-2019-5239 · Davical · Davical

Name of the Vulnerable Software and Affected Versions: DAViCal versions through 1.1.8 Description: A reflected XSS issue was discovered in DAViCal. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can vie...

CVE-2013-0202

Cross-site scripting XSS vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to core/ajax/sharing.php...

PT-2019-6837

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.5, 4.0.10, and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the action parameter to "core/ajax/sharing.php" API endpoint. This enables attackers to perform cross-site...

CVE-2013-0202: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to core/ajax/sharing.php...

CVE-2019-15071

The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting XSS vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of...

PT-2019-13969

Name of the Vulnerable Software and Affected Versions MAIL2000 versions 6.0 and 7.0 Description The issue allows for the execution of arbitrary code via the ACTION parameter in the "/cgi-bin/go" page without requiring authentication. This can be executed for any user accessing the page. It is...

CVE-2019-15071: Improper Neutralization of Input During Web Page Generation

The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting XSS vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of...

CVE-2019-15095

DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter...

CVE-2019-14708

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. A buffer overflow in the action parameter leads to remote code execution in the context of the nobody account...

PT-2019-13800

Name of the Vulnerable Software and Affected Versions MicroDigital N-series cameras versions through 6400.0.8.5 Description A buffer overflow issue exists due to the action parameter, which can lead to remote code execution in the context of the nobody account. Recommendations For versions throug...

CVE-2019-14708: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. A buffer overflow in the action parameter leads to remote code execution in the context of the nobody account...

CVE-2019-14333

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated denial of service attack against the access point via a long action parameter to admin.cgi...

PT-2019-13618

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue allows for a post-authenticated dump of all configuration files through a certain "admin.cgi?action=" insecure HTTP request. Recommendations For D-Link 6600-AP and DWL-3600...

PT-2019-13615

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered that allows a pre-authenticated denial of service attack against the access point. This can be achieved via a long action parameter to the "admin.cgi"...

CVE-2019-14333: Undefined Security Weakness

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated denial of service attack against the access point via a long action parameter to admin.cgi...

PT-2019-13158

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-827DRU versions prior to 2.05B11 Description An issue was discovered in the firmware, where a command injection is possible in the "apply.cgi" endpoint, specifically via the "action" parameter with the value "set sta enrollee pin...

PT-2019-9227

Name of the Vulnerable Software and Affected Versions BIBLIOsoft BIBLIOpac version 2008 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to the "/bin/wxis.exe/bibliopac/" API endpoint. Recommendations For...