CVE-2018-4020: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

PT-2018-16369

Name of the Vulnerable Software and Affected Versions pfSense CE version 2.4.4-RELEASE Description A command injection issue exists in the way pfSense CE processes the parameters of a specific POST request, allowing an attacker to execute arbitrary commands on the system. The attacker must be abl...

[SECURITY] Fedora 29 Update: perl-5.28.1-425.fc29

Perl is a high-level programming language with roots in C, sed, awk and she ll scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

Exploit for CVE-2013-6026

PoC exploit for CVE-2013-6026, a severe vulnerability allowing unauthenticated access to the administration panel of many routers made by D-Link. The target product/service is D-Link routers, and the vulnerability class/vector is auth bypass. The probable entry point is the Shodan search engine,...

Oracle Secure Global Desktop Administration Console Cross-Site Scripting Vulnerability

Oracle Secure Global Desktop SGD is a desktop virtualization product from Oracle Corporation. It allows users to access server-hosted applications and desktops.Administration Console is one of the administration console programs. A cross-site scripting vulnerability exists in the helpwindow.jsp...

CVE-2018-19559

CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the referenceid parameter...

CVE-2018-19562

An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background Program Upgrade Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive...

Oracle Secure Global Desktop Administration Console 4.4 Cross Site Scripting Vulnerability

Oracle Secure Global Desktop Administration Console version 4.4 build 20080807152602 suffers from cross site scripting vulnerabilities. alert"XSS" helpFile=concepts.html&pageTitle=Administrator Help&mastheadUrl=/images/productNameSecondaryMasthead.png&mastheadDescription=Sun Secure Global Desktop...

Janusec Application Gateway - Tool Which Provides WAF, CC Attack Defense, Unified Web Administration Portal, Private Key Protection, Web Routing And Scalable Load Balancing

Janusec Application Gateway, an application security solutions which provides WAF Web Application Firewall, unified web administration portal, private key protection, web routing and scalable load balancing. With Janusec, you can build secure and scalable applications. Key Features WAF Web...

Security Bulletin: Cross-site scripting vulnerability in CacheMonitor for WebSphere Application Server shipped with Jazz for Service Management (CVE-2018-1767)

Summary There is a potential cross-site scripting vulnerability in the Admin Console for WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1767 DESCRIPTION: IBM WebSphere Application Server CacheMonitor is vulnerable to cross-site scripting. This vulnerability allows users to...

Oracle Secure Global Desktop Administration Console 4.4 Cross Site Scripting

alert"XSS" helpFile=concepts.html&pageTitle=Administrator Help&mastheadUrl=/images/productNameSecondaryMasthead.png&mastheadDescription=Sun Secure Global Desktop Administration&jspPath=/sgdadmin/faces/comsunwebui/help/&mastheadHeight=40&mastheadWidth=20 Vulnerables parameters: windowTitle,...

PT-2018-2868

Name of the Vulnerable Software and Affected Versions Oracle Secure Global Desktop versions prior to 5.4 Description The issue exists due to inadequate protection of the web page structure in the administration console. This can allow a remote attacker to execute arbitrary code in the user's...

CVE-2018-19404

In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at an external URL, and visiting index.php?r=appmanage/index/onlineinstall&url=...

SAP Basis Remote Code Execution Vulnerability

SAP BASIS is a role engaged in sap system administration. Mainly responsible for sap system planning, installation, configuration, management, monitoring, maintenance, tuning, etc.. A remote code execution vulnerability exists in SAP Basis, which can be exploited by an attacker to execute arbitra...

CentOS 7 : 389-ds-base (CESA-2018:3127)

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

CVE-2018-14935

The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS...

CVE-2018-14935

The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS...

Cross site scripting

The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS...

CVE-2018-14935

The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS...

CVE-2018-14935

The CVE-2018-14935 entry maps to a web-based XSS in the Web administration console of Polycom Trio devices running software before 5.5.4. Affected component: the web admin UI. Root cause: reflected/scripted input in the console without proper encoding. Impact: user-facing XSS could affect confide...