Cross site request forgery (csrf)

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...

CVE-2019-13376

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...

Design/Logic Flaw

ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to perform administrative actions...

Open redirect

ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext...

CVE-2019-5505

ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext...

CVE-2019-5505

The CVE-2019-5505 issue affects NetApp ONTAP Select Deploy admin utility versions 2.2–2.12.1, where credentials are transmitted in plaintext. The combined documents identify the root cause as unencrypted credential handling in the deploy utility, leading to potential credential disclosure. The vu...

CVE-2019-5504

The CVE-2019-5504 entry concerns ONTAP Select Deploy administration utility versions 2.12 and 2.12.1. The vulnerability arises because an HTTP service is bound to the network, allowing unauthenticated remote attackers to perform administrative actions. Documents confirm the affected product (ONTA...

CVE-2019-5504

ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to perform administrative actions...

Trump’s Ukraine Mess Feels a Little Too Familiar

The unfolding drama ties two key threads of the Trump era: foreign interference in US elections and the president's distrust of his own intel agencies...

CVE-2019-5504: Missing Authentication for Critical Function

ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to perform administrative actions...

CVE-2019-5505: Cleartext Transmission of Sensitive Information

ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext...

Exploit for OS Command Injection in Webmin

Make-and-Break Create and exploit a vulnerable Virtual Mac...

CVE-2019-14913

An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel...

Cross site scripting

An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel...

CVE-2019-14913

PRiSE adAS 1.7.0 is affected by a persistent XSS in the administration panel due to log data not being properly escaped. Root cause: inadequate escaping in the logging path. Impact: XSS could affect users with access to the admin UI; exact exploit details, affected components, versions beyond 1.7...

CVE-2019-14913

An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel...

LY Corporation: Able to Become Admin for Any LINE Official Account

The reporter found an issue where abusing an IDOR would allow for an attacker to become an administrator of any LINE Official Account. This was due to an issue where the group ID could be extracted and/or easily guessed, combined with lack of authentication, leading to being able to craft a reque...

CVE-2019-14913: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel...

CVE-2019-4271

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability. IBM X-Force ID: 160243...

CVE-2010-5333

The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable software. This CVE is t...