2550 matches found
CVE-2019-20139
In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user...
Design/Logic Flaw
In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user...
CVE-2019-20139
In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user...
CVE-2019-20139
CVE-2019-20139 affects Nagios XI 5.6.9 with a stored/reflected XSS vulnerability exposed via nocscreenapi.php (host, hostgroup, servicegroup parameters) or schedulereport.php (hour or frequency). An authenticated user can exploit this to attack the admin user. The connected documents corroborate ...
D-Link DCS-960L HNAP SOAPAction Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link DCS-960L. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HNAP service, which listens on TCP port 80 by default. When parsing the SOAPAction...
CVE-2019-19340
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmqenablemanager=true' exposes the RabbitMQ management interface publicly, as expected. If the default admin user is still active, an attacker could...
D-Link DIR-615 Input Validation Error Vulnerability
The D-Link DIR-615 is a wireless router from AUO D-Link of Taiwan, China. The D-Link DIR-615 suffers from an input validation error vulnerability. An attacker can exploit this vulnerability to create a root admin user...
CVE-2019-19743
On D-Link DIR-615 devices, a normal user is able to create a rootadmin user from the D-Link portal...
CVE-2019-10694
CVE-2019-10694 affects Puppet Enterprise where the Express install could leave an overlooked default password for the admin user if the user did not use the URL provided to set the password. The issue is resolved in Puppet Enterprise 2019.0.3 and in 2018.1.9. The public descriptions consistently ...
DEBIAN-CVE-2019-18346
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user...
TP-LINK TL-WR841N Web Service http_parser_main Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 80 by default. When parsing the Hos...
Apache Airflow vulnerable to XSS and local file disclosure
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process...
GHSA-Q3P4-GW7R-WQJC Apache Airflow vulnerable to XSS and local file disclosure
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process...
Yoti: Multiple Vulnerabilities in (*www.yoti.com) - Leads to Leakage user admin Sensitive Exposure
Sumarry Hi! Team @yoti, We Found Multiple Vulnerabilities in you websites , Username Admin Login Sensitive Exposure All Sensitive Exposure Using Shodan Platforms Affected: website . https://185.116.54.11/wp-json . https://185.116.54.11/wp-json/wp/v2/users POC Supporting Material/References...
CVE-2019-18648
When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...
CVE-2019-18649
When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...
CVE-2019-18649
When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...
CVE-2019-18646
The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...