12014 matches found
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php...
accesorii-telefoane.net XSS vulnerability
Open Bug Bounty ID: OBB-578862 Description| Value ---|--- Affected Website:| accesorii-telefoane.net Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:...
Media Streaming add-on request authentication vulnerability
The Media Streaming add-on is an add-on for each station in QTS that allows you to stream media simultaneously to different devices in different locations using AirPlay, DLNA, Chromecast, and HDMI-connected devices. A request authentication vulnerability exists in the QNAP NAS application Media...
QNAP NAS application Media Streaming add-on arbitrary OS command execution vulnerability
QNAP NAS application Media Streaming add-on is a video streaming loading application for QNAP NAS devices from QNAP Systems. A security vulnerability exists in the QNAP NAS application Media Streaming add-on version 421.1.0.2 and earlier and version 430.1.2.0 and earlier. A remote attacker can...
Media Streaming add-on Cross-Site Request Forgery Vulnerability
QNAP NAS application Media Streaming add-on is a video streaming loading application for QNAP NAS devices from QNAP Systems. A security vulnerability exists in QNAP NAS application Media Streaming add-on 421.1.0.2 and earlier and 430.1.2.0 and earlier, which stems from the program not implementin...
CVE-2017-7638
CVE-2017-7638 affects QNAP NAS Media Streaming add-on (versions 421.1.0.2, 430.1.2.0 and earlier). The vulnerability is that the add-on does not authenticate requests properly, which could allow an attacker to change Media Streaming settings and access sensitive information on the NAS. Connected ...
PHP Scripts Mall Hot Scripts Clone:Script Classified Cross-Site Scripting Vulnerability
PHP Scripts Mall Hot Scripts Clone:Script Classified is a set of PHP based classifieds posting scripts by PHP Scripts Mall India. A cross-site scripting vulnerability exists in the Add New feature of PHP Scripts Mall Hot Scripts Clone:Script Classified version 3.1, which stems from the program's...
CVE-2018-7733
An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/addpost.html...
Design/Logic Flaw
PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a Management User. Within the "Add New" section, the application does not sanitize user supplied input to the name parameter, and renders injected JavaScript...
CVE-2018-7650
PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a Management User. Within the "Add New" section, the application does not sanitize user supplied input to the name parameter, and renders injected JavaScript...
CVE-2018-7650
PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a Management User. Within the "Add New" section, the application does not sanitize user supplied input to the name parameter, and renders injected JavaScript...
The vulnerability of the “add repo” component in the Cobbler network installation server allows a hacker to execute arbitrary code with root privileges.
The vulnerability of the “add repo” component in the Cobbler network installation server is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with root privileges...
The vulnerability in the messageAddArgument function of the Clam Antivirus protection library allows a hacker to cause a service failure or execute arbitrary code.
The vulnerability in the AddArgument function of the Clam Antivirus protection tool arises from an operation that goes beyond the buffer boundaries in memory during message processing. Exploiting this vulnerability allows a remote attacker to cause service failures or execute arbitrary code using...
Mail.ru: XSS в нике при запросе в контакты.
Stored XSS in web.icq.com via nickname in contact add request...
The vulnerability of the perfAddFormServer.gwtsvc component in the HPE Intelligent Management Center PLAT software platform allows a perpetrator to execute arbitrary code.
The vulnerability of the perfAddFormServer.gwtsvc component in the HPE Intelligent Management Center PLAT software platform is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely by using the beanName...
Open source PHP message feedback management system has XSS vulnerability
Open source PHP message feedback management system is a second development by avenjan a set of small and medium-sized enterprises and personal website for the message feedback management program system , based on PHP MySQL + Bootstrap development , open source and free to use . Open source PHP...
NoneCms Cross-Site Request Forgery Vulnerability
NoneCms is a simple and compact open-source content management system that can be used to quickly build corporate sites, personal blogs, and support mobile. A cross-site request forgery vulnerability exists in application/admin/controller/Admin.php in NoneCms 1.3.0. Attackers can use this...
CVE-2018-7308
CVE-2018-7308 affects DanWin hosting (var/www/html/files.php) up to 2018-02-11. The vulnerability is a cross-site request forgery (CSRF) that lets arbitrary remote users add/delete/modify files in any hosting account. Root cause is CSRF in the affected script; no exploitation details are provided...
