CVE-2017-15673: Unrestricted Upload of File with Dangerous Type

The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP code via vectors involving a custom page...

Synchronization State for WEM Agents shows question mark (?) on WEM Administration Console

Synchronization State for WEM Agents shows a question mark ? or red crosson the WEM Administration console...

PT-2017-14145

Name of the Vulnerable Software and Affected Versions CS-Cart versions 4.6.2 and earlier Description The issue allows attackers to execute arbitrary PHP code via vectors involving a custom page in the administration section. This is related to the files function. Recommendations For CS-Cart...

CSC Cart 4.6.2 Shell Upload Vulnerability

Exploit for php platform in category web applications Summary CSC Cart is a PHP based shopping cart software, which is hosted either locally or by the company csc-cart company. It has a vulnerability in the administration section, which allows full remote code execution on the server. This has be...

MyTy 5.1.7 Cross Site Scripting Vulnerability

MyTy versions 5.0.4 through 5.1.7 suffer from a cross site scripting vulnerability. Product: MyTy Vendor: Finlane GmbH CSNC ID: CSNC-2017-030 CVE ID: - Subject: Reflected Cross-Site Scripting XSS Risk: High Effect: Remotely exploitable Author: Nicolas Heiniger Date: 21.11.2017 Introduction:...

MyTy 5.1.7 Cross Site Scripting

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: MyTy Vendor: Finlane GmbH CSNC ID: CSNC-2017-030 CVE ID: - Subject: Reflected Cross-Site Scripting XSS Risk: High Effect: Remotely exploitable Author: Nicolas Heiniger Date: 21.11.2017 Introduction:...

PT-2017-3133 · Intel · Intel Manageability Engine Firmware

Name of the Vulnerable Software and Affected Versions: Intel Manageability Engine Firmware versions 8.x through 11.20 Description: The issue is caused by a buffer overflow in the Active Management Technology AMT subsystem, allowing an attacker with remote Admin access to execute arbitrary code wi...

Design/Logic Flaw

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface...

CVE-2017-13700

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface...

CVE-2017-13700

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface...

CVE-2017-13700

The CVE-2017-13700 entry affects MOXA EDS-G512E devices (firmware version 5.1, build 16072215). The vulnerability is a cross-site scripting (XSS) flaw in the device’s administration interface. The available documents do not specify root cause details beyond the XSS description, nor do they provid...

PT-2017-13029

Name of the Vulnerable Software and Affected Versions MOXA EDS-G512E version 5.1 build 16072215 Description An issue was discovered in the administration interface of the affected device, which is susceptible to cross-site scripting XSS. This means that an attacker could potentially inject...

CVE-2017-13700: Improper Neutralization of Input During Web Page Generation

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface...

Free, Open-Source Remote Administration Tool for Windows: QuasarRAT

Quasar is a fast and light-weight remote administration tool coded in C. Providing high stability and an easy-to-use user interface, Quasar is the perfect remote administration solution for you. Features TCP network stream IPv4 & IPv6 support Fast network serialization NetSerializer Compressed...

PT-2017-14263

Name of the Vulnerable Software and Affected Versions Axis 2100 Network Camera version 2.03 Description The issue concerns a Reflected XSS in the web administration portal. An attacker can execute arbitrary JavaScript via the conf Layout OwnTitle parameter to the "view/view.shtml" endpoint...

Mosaik - Moderately critical - Cross-site scripting - SA-CONTRIB-2017-080

The Mosaik module enables you to create pages or complex blocks in Drupal with the logic of a real mosaic and its pieces. The module doesn't sufficiently sanitize the titles of fieldsets on its administration pages or the titles of blocks that it creates. This vulnerability is mitigated by the fa...

CVE-2017-15885: Improper Neutralization of Input During Web Page Generation

Reflected XSS in the web administration portal on the Axis 2100 Network Camera 2.03 allows an attacker to execute arbitrary JavaScript via the confLayoutOwnTitle parameter to view/view.shtml. NOTE: this might overlap CVE-2007-5214...

PT-2017-14242 · WordPress · Easyappointments

Name of the Vulnerable Software and Affected Versions: Easy Appointments plugin versions prior to 1.12.0 Description: The issue concerns a cross-site scripting XSS flaw. This flaw is located in the Settings values within the admin panel. Recommendations: For versions prior to 1.12.0, update to...

SAP Customer Relationship Management Java administration console cross-site scripting vulnerability

SAP Customer Relationship Management CRM is a set of customer relationship management solutions from SAP. The program includes sales management , marketing management , customer service systems and other modules . Java administration console is one of the Java administration console . A cross-sit...

CVE-2017-10400

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Administration Graphical User Interface. The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...