1824 matches found
CVE-2019-3915
Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway G1100 firmware version 02.01.00.05 allows an unauthenticated attacker with adjacent network access to intercept and replay login requests to gain access to the administrative web interface...
CVE-2019-9660
Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter...
OFCMS Backend Arbitrary File Write Vulnerability
OFCMS is a content management system based on Java technology. OFCMS version before 1.1.3 has a backend arbitrary file write vulnerability. An attacker can exploit this vulnerability by traversing the admin/cms/template/getTemplates.html?respath=res directory to write arbitrary content in the...
CVE-2019-9608
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadImage URI...
Stored XSS Vulnerability in DOYO Administrator Interface
DOYO doyocms is a PHP-based open source content management system CMS. A cross-site scripting vulnerability exists in the admin.php backend in DOYO version 2.3 through 2015-05-06. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
The vulnerability of the administrative web interface of the Cisco Identity Services Engine allows a perpetrator to increase their privileges.
The vulnerability of the administrative web interface of the Cisco Identity Services Engine relates to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges through specially crafted HTTP requests...
The vulnerability in the web interface of the Cisco WebEx Meetings Server software allows attackers to execute cross-site scripting attacks.
The vulnerability of the administration web interface of Cisco WebEx Meetings Server software is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially crafted link...
CVE-2018-15459
A vulnerability in the administrative web interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to gain additional privileges on an affected device. The vulnerability is due to improper controls on certain pages in the web interface. An attacker could explo...
CVE-2018-15459
CVE-2018-15459 : Cisco Identity Services Engine (ISE) has a privilege-escalation flaw in its administrative web interface. An authenticated administrator can send crafted HTTP requests to gain additional Admin accounts with different roles, enabling actions within their scope. The root cause is i...
Remote Code Execution (RCE)
conga is vulnerable to remote code execution RCE attacks. The vulnerability exists as registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface...
Information Disclosure Through Escalation Of Privileges
Django is vulnerable to information disclosure through escalation of privileges. The admin interface does not check user permissions correctly for viewing object history...
Technicolor MediaAccess TG789vac v2 HP Device Cross-Site Scripting Vulnerability
Technicolor MediaAccess TG789vac v2 HP is a gateway device from the French Technicolor group. A cross-site scripting vulnerability exists in the admin web interface of Technicolor MediaAccess TG789vac v2 HP devices with firmware version 16.3.7190-2761005-20161004084353, which can be exploited by...
CVE-2018-8827
The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitised user input, which allows an unauthenticated malicious user to embed JavaScript into the Log viewer interface via a crafted HTTP Referer header, aka XSS...
The vulnerability of the Cisco Prime Collaboration Provisioning software installation component for centralized product management allows a hacker to gain access to the administrative web interface with administrator privileges.
The vulnerability of the Cisco Prime Collaboration Provisioning software installation component for centralized product management involves the use of pre-installed user accounts. Exploiting this vulnerability could allow an attacker to gain access to the administrative web interface with...
CVE-2018-1000847
FreshDNS version 1.0.3 and prior contains a Cross Site Scripting XSS vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted string as their Ful...
Cross site scripting
FreshDNS version 1.0.3 and prior contains a Cross Site Scripting XSS vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted string as their Ful...
CVE-2018-1000847
FreshDNS version 1.0.3 and prior contains a Cross Site Scripting XSS vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted string as their Ful...
CVE-2018-7067
A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all versions of ClearPass could allow an attacker to compromise the entire cluster through a specially crafted API call. Network access to the administrative web...
Cross-site Scripting Vulnerability in Discuz!
Discuz! is a very popular Web forum program in the Chinese community. A cross-site scripting vulnerability exists in Discuz! X3.4, which stems from the failure of admincp/admincpsetting.php and template\default\common\footer.htm to properly handle the statcode field, which can be exploited to...