Jirafeau Cross-Site Scripting Vulnerability

Jirafeau is a file sharing website system. A cross-site scripting vulnerability exists in the 'search file by hash' form in Jirafeau versions prior to 3.4.1. A remote attacker can exploit this vulnerability to steal sessions and gain administrative privileges...

CVE-2018-7778

In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users...

PT-2018-18954 · Paessler · Prtg Network Monitor

Name of the Vulnerable Software and Affected Versions: PRTG Network Monitor versions prior to 18.2.39 Description: An issue was discovered that allows an attacker with access to the PRTG System Administrator web console and administrative privileges to exploit an OS command injection vulnerabilit...

Micro Focus Secure Messaging Gateway Web administration and quarantine component SQL injection vulnerability

Micro Focus Secure Messaging Gateway SMG is a suite of outbound and inbound protection software for enterprise networks and messaging systems from Micro Focus, UK. The product includes features such as virus protection, anti-spam, anti-DDos attacks, and image analysis.Web administration is one of...

The vulnerability of the components ExportSettings.sh, updateWPS, RebootSystem, and vpnBasicSettings of the Intelbras NCLOUD 300 Wi-Fi router’s microprogramming system allows a hacker to gain access to the device with administrator privileges.

The vulnerabilities of the components ExportSettings.sh /cgi-bin/ExportSettings.sh, updateWPS /goform/updateWPS, RebootSystem /goform/RebootSystem, and vpnBasicSettings /goform/vpnBasicSettings of the Intelbras NCLOUD 300 Wi-Fi router software are related to the use of pre-installed registration...

CVE-2018-1000502

MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel Tools and Maintenance - Task Manager - Add New Task that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusion on ancient PHP versions. This attack appear to be exploitable via Must have...

Design/Logic Flaw

Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the filesystem. This attack appear to be exploitable via Attacker must be have access to an admin account on the target site. This vulnerabili...

CVE-2018-1000504

Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the filesystem. This attack appear to be exploitable via Attacker must be have access to an admin account on the target site. This vulnerabili...

CVE-2018-1000508

WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting XSS vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3...

CVE-2018-1000509

Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result in could allow admin to execute arbitrary code in some circumstances. This attack appear to be exploitable via Attacker must have access to admin account. Thi...

SLiMS 8 CSRF Protection Bypass Vulnerability

SLiMS 8 Akasia is an open source, free library management system. A security vulnerability exists in SLiMS 8 Akasia version 8.3.1. A remote attacker can exploit the vulnerability by removing the 'csrftoken' parameter to bypass cross-site request forgery protection and gain administrator access...

Cross site request forgery (csrf)

SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrftoken parameter...

CVE-2018-12659

SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrftoken parameter...

CVE-2018-12659

CVE-2018-12659 affects SLiMS 8 Akasia 8.3.1. The issue is a CSRF protection bypass where an attacker can obtain administrator access by omitting the csrf_token parameter. The root cause is the failure to enforce CSRF token verification, allowing remote exploitation. Documented impacts include adm...

CVE-2018-12659

SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrftoken parameter...

Security Bulletin: A command injection vulnerability has been identified in IBM Security Access Manager for Mobile appliances (CVE-2016-3028)

Summary A vulnerability in IBM Security Access Manager for Mobile could allow a remote authenticated attacker with admin access to the LMI to execute arbitrary commands on the system. Vulnerability Details CVEID: CVE-2016-3028 DESCRIPTION: IBM Security Access Manager for Mobile could allow a remo...

Security Bulletin: A command injection vulnerability has been identified in IBM Security Access Manager for Web appliances (CVE-2016-3028)

Summary A vulnerability in IBM Security Access Manager for Web could allow a remote authenticated attacker with admin access to the LMI to execute arbitrary commands on the system. Vulnerability Details CVEID: CVE-2016-3028 DESCRIPTION: IBM Security Access Manager for Web could allow a remote...

CVE-2018-12323

An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin accounts, which makes it easier for physically proximate attackers to login at the console...

CVE-2018-12263

portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI...

SIEMENS SCALANCE M875 Cross-Site Request Forgery Vulnerability

SCALANCE M industrial routers are used for secure remote access to the plant via mobile networks, e.g. GPRS or UMTS, with integrated security features such as firewalls to prevent unauthorized access and VPNs to protect data transmission. A cross-site request forgery vulnerability exists in SIEME...