Security feature bypass

IBM Tivoli NetView Access Services NVAS allows remote authenticated users to gain privileges by entering the ADM command and modifying a "page ID" field to the EMSPG2 transaction code. NOTE: the vendor's perspective is that configuration and use of available security controls in the NVAS product...

CVE-2014-9768: Undefined Security Weakness

IBM Tivoli NetView Access Services NVAS allows remote authenticated users to gain privileges by entering the ADM command and modifying a "page ID" field to the EMSPG2 transaction code. NOTE: the vendor's perspective is that configuration and use of available security controls in the NVAS product...

PT-2015-4132

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.13 through 1.2.17 Description A cross-site scripting XSS issue exists in the Configuration Report page, specifically in the "set configuration" box, allowing remote administrators to inject arbitrary web script or HTML...

MantisBT 'adm_config_report.php' cross-site scripting vulnerability (CNVD-2015-01092)

MantisBT is a popular web-based bug tracking system written in PHP. A cross-site scripting vulnerability exists in MantisBT 'admconfigreport.php' due to the program failing to adequately filter user-supplied input. An attacker could exploit this vulnerability to execute arbitrary script code or...

PT-2019-6864

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.0rc1 through 1.2.14 Description A cross-site scripting issue exists in the configuration report page, allowing remote authenticated users to inject arbitrary web script or HTML via a complex value in the adm config...

CVE-2011-5302

PHPDug 2.0.0 is affected by CVE-2011-5302, a CSRF flaw in adm/admin_edit.php that can allow an attacker to hijack administrator sessions and modify credentials. Root cause is a Cross-site request forgery vulnerability in the admin_edit.php endpoint. Multiple sources document the affected componen...

CVE-2011-5302: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in adm/adminedit.php in PHPDug 2.0.0 allows remote attackers to hijack the authentication of administrators for requests that modify credentials...

PT-2015-3498

Name of the Vulnerable Software and Affected Versions PHPDug version 2.0.0 Description A cross-site request forgery issue exists, allowing remote attackers to hijack administrator authentication for requests that modify credentials. This occurs in the adm/admin edit.php file. Recommendations For...

Solaris 2.6/7.0/8 netpr Buffer Overflow Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/1200/info A buffer overrun exists in the 'netpr' program, part of the SUNWpcu LP package included with Solaris, from Sun Microsystems. Versions of netpr on Solaris 2.6 and 7, on both Sparc and x86 have been confirmed as...

JFFNMS 0.8.3 admin/adm/test.php PHP Information Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/24414/info Just For Fun Network Management and Monitoring System JFFNMS is prone to multiple remote vulnerabilities, including a cross-site scripting issue, an SQL-injection issue, and multiple information-disclosure...

wu-ftpd 2.6.0 - Remote Root Exploit

No description provided by source. / c 2000 venglin / b0f http://b0f.freebsd.lublin.pl WUFTPD 2.6.0 REMOTE ROOT EXPLOIT 22/06/2000, updated: 05/08/2000 Idea and preliminary version of exploit by tf8 Greetz: Lam3rZ, TESO, ADM, lcamtuf, karpio. Dedicated to ksm. PRIVATEDONOTDISTRIBUTE / include...

PT-2014-4576

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.13 through 1.2.16 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the filter config id parameter in the manage configuration page, specifically in t...

Design/Logic Flaw

TRENDnet TEW-812DRU router allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 wan network prefix to internet/ipv6.asp; 2 remote port to adm/management.asp; 3 pptp username, 4 pptp password, 5 ip, 6 gateway, 7 l2tp username, or 8 l2tp password to...

CVE-2013-3365: Improper Neutralization of Special Elements used in an OS Command

TRENDnet TEW-812DRU router allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 wan network prefix to internet/ipv6.asp; 2 remote port to adm/management.asp; 3 pptp username, 4 pptp password, 5 ip, 6 gateway, 7 l2tp username, or 8 l2tp password to...

CVE-2012-5942

IBM TADDM 7.2.x is affected by CVE-2012-5942: a cross-site scripting flaw in the Data Management Portal Web User Interface (Welcome.do) caused by improper validation of user input. A remote authenticated attacker could inject content and facilitate phishing via the Web UI. Affected versions are 7...

elisioimoveis - SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 x...

PT-2012-3655

Name of the Vulnerable Software and Affected Versions RealNetworks Helix Server and Helix Mobile Server versions 14.x before 14.3.x Description The issue allows local users to obtain sensitive information by reading a database, as passwords are stored in cleartext under adm b dbusers...

CVE-2009-4223: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in adm/krgourl.php in KR-Web 1.1b2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENTROOT parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allow remote attackers to inject arbitrary web script or HTML via the nextfile parameter to 1 main.cgi, 2 img/main.cgi, or 3 adm/file.cgi; or 4 the thisfile...

CVE-2009-1559: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R24 and possibly 1.00R22 allows remote attackers to read arbitrary files via an absolute pathname in the thisfile parameter. NOTE: traversal via a .. dot dot is probably als...