CVE-2018-19439: Improper Neutralization of Input During Web Page Generation

XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 but was fixed in later versions including 5.4. helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/comsunwebui/help/helpwindow.jsp windowTitle parameter...

Oracle Secure Global Desktop Administration Console Cross-Site Scripting Vulnerability

Oracle Secure Global Desktop SGD is a desktop virtualization product from Oracle Corporation. It allows users to access server-hosted applications and desktops.Administration Console is one of the administration console programs. A cross-site scripting vulnerability exists in the helpwindow.jsp...

Oracle Secure Global Desktop Administration Console 4.4 Cross Site Scripting Vulnerability

Oracle Secure Global Desktop Administration Console version 4.4 build 20080807152602 suffers from cross site scripting vulnerabilities. alert"XSS" helpFile=concepts.html&pageTitle=Administrator Help&mastheadUrl=/images/productNameSecondaryMasthead.png&mastheadDescription=Sun Secure Global Desktop...

PT-2018-2868

Name of the Vulnerable Software and Affected Versions Oracle Secure Global Desktop versions prior to 5.4 Description The issue exists due to inadequate protection of the web page structure in the administration console. This can allow a remote attacker to execute arbitrary code in the user's...

Oracle Secure Global Desktop Administration Console 4.4 Cross Site Scripting

alert"XSS" helpFile=concepts.html&pageTitle=Administrator Help&mastheadUrl=/images/productNameSecondaryMasthead.png&mastheadDescription=Sun Secure Global Desktop Administration&jspPath=/sgdadmin/faces/comsunwebui/help/&mastheadHeight=40&mastheadWidth=20 Vulnerables parameters: windowTitle,...

CVE-2018-14935

The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS...

CVE-2018-14935

The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS...

CVE-2018-14935

The CVE-2018-14935 entry maps to a web-based XSS in the Web administration console of Polycom Trio devices running software before 5.5.4. Affected component: the web admin UI. Root cause: reflected/scripted input in the console without proper encoding. Impact: user-facing XSS could affect confide...

CVE-2018-14935: Improper Neutralization of Input During Web Page Generation

The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS...

PT-2018-12810

Name of the Vulnerable Software and Affected Versions Polycom Trio devices versions prior to 5.5.4 Description The issue affects the Web administration console, where a cross-site scripting XSS problem exists. This could potentially allow attackers to execute malicious scripts. Recommendations Fo...

Oracle WebLogic Server Administration Console Detected

Oracle WebLogic Server administration console has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative...

CVE-2018-8006

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter...

CVE-2018-8006: Improper Neutralization of Input During Web Page Generation

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter...

PT-2018-18376

Name of the Vulnerable Software and Affected Versions: Apache ActiveMQ versions 5.0.0 through 5.15.5 Description: A cross-site scripting issue was found in the web-based administration console, specifically on the queue.jsp page. The root cause is improper data filtering of the QueueFilter...

Oracle Glassfish OSE 4.1 - Path Traversal (Metasploit)

Oracle Glassfish OSE 4.1 - Path Traversal Metasploit Exploit title: Oracle Glassfish OSE 4.1 - Path Traversal Metasploit Author: Dhiraj Mishra Date: 2018-08-14 Software: Oracle Glassfish Server OSE Version: 4.1 Software link: http://download.oracle.com/glassfish/4.1/release/glassfish-4.1.zip CVE:...

Oracle Glassfish OSE 4.1 - Path Traversal (Metasploit)

Exploit title: Oracle Glassfish OSE 4.1 - Path Traversal Metasploit Author: Dhiraj Mishra Date: 2018-08-14 Software: Oracle Glassfish Server OSE Version: 4.1 Software link: http://download.oracle.com/glassfish/4.1/release/glassfish-4.1.zip CVE: 2017-1000028 This module requires Metasploit:...

Oracle GlassFish Server Open Source Edition 4.1 - Path Traversal (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Path Traversal in Oracle GlassFish Server Open Source Edition', 'Description' = %q This module exploits an unauthenticated directory traversal...

CVE-2018-14417

A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion' parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary commands with root...

Command injection

A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion' parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary commands with root...

PT-2018-12498

Name of the Vulnerable Software and Affected Versions SoftNAS Cloud versions prior to 4.0.3 Description A command injection issue was discovered in the web administration console. Specifically, the snserv script failed to sanitize the recentVersion parameter from the "snserv endpoint", allowing a...