12601 matches found
NUUO NVRMini2 Multiple Vulnerabilities
The version of NUUO NVRMini2 installed on the remote host is affected by multiple vulnerabilities: - NUUO NVRMini2 web server utilizes CGI binaries in order to handle a variety of commands that require authenticated interaction. Implemented session handling mechanism doesn't validate user's input...
CVE-2018-17021
Cross-site scripting XSS vulnerability on ASUS GT-AC5300 devices with firmware through 3.0.0.4.38432738 allows remote attackers to inject arbitrary web script or HTML via the appGet.cgi hook parameter...
ukerc.rl.ac.uk XSS vulnerability
Open Bug Bounty ID: OBB-676402 Description| Value ---|--- Affected Website:| ukerc.rl.ac.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-16591
FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service accounts, as well as the password for the protected "SMS" panel via /cgi-bin/smchangepassword.cgi and /cgi-bin/smsmschangepasswd.cgi...
CVE-2018-16591
CVE-2018-16591 affects FURUNO FELCOM 250 and FELCOM 500 devices. The issue allows unauthenticated users to change passwords for Admin, Log, and Service accounts, as well as the protected SMS panel via /cgi-bin/sm_changepassword.cgi and /cgi-bin/sm_sms_changepasswd.cgi. Documented impact is creden...
PT-2018-13634
Name of the Vulnerable Software and Affected Versions FURUNO FELCOM versions 250 and 500 Description The issue allows unauthenticated users to change passwords for critical accounts, including Admin, Log, and Service, as well as the protected "SMS" panel. This is achieved through access to specif...
CVE-2018-16591: Missing Authorization
FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service accounts, as well as the password for the protected "SMS" panel via /cgi-bin/smchangepassword.cgi and /cgi-bin/smsmschangepasswd.cgi...
9tox.de XSS vulnerability
Open Bug Bounty ID: OBB-674695 Description| Value ---|--- Affected Website:| 9tox.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
[SECURITY] Fedora 28 Update: mod_perl-2.0.10-11.fc28
Modperl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. Modperl links the Perl run-time library into the Apache web server and provides an object-oriented Perl interface for Apache's C language API. The end result is a...
[SECURITY] Fedora 27 Update: mod_perl-2.0.10-9.fc27
Modperl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. Modperl links the Perl run-time library into the Apache web server and provides an object-oriented Perl interface for Apache's C language API. The end result is a...
Schneider Electric Modicon Authentication Bypass
The vulnerability of Schneider Electric’s built-in web server controls—Modicon Premium, Modicon Quantum PLC, Modicon M340, and Modicon BMXNOR0200—is caused by errors in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to bypass the authentication process using...
CVE-2018-1000669
KOHA Library System version 16.11.x up until 16.11.13 and 17.05.x up until 17.05.05 contains a Cross Site Request Forgery CSRF vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters affected: borrowernumber, amount, amountoutstanding, paid that can result in Attackers can mark payments a...
PT-2018-9521
Name of the Vulnerable Software and Affected Versions KOHA Library System versions 16.11.x through 16.11.13 KOHA Library System versions 17.05.x through 17.05.05 Description The issue allows attackers to mark payments as paid for certain users on behalf of administrators due to a Cross Site Reque...
Ansible Tower Unsupported Version
The version of Ansible Tower running on the remote server has reached the end of support, and will no longer receive security updates from the vendor. It could therefore be affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
Joomla! < 3.8.12 Multiple Vulnerabilities
According to its self-reported version number, the Joomla! installation running on the remote web server is prior to 3.8.12. It is, therefore, affected by malicious file upload and stored cross-site scripting vulnerabilities. Additionally, versions 3.7.0 through 3.8.11 are affected by an access...
CVE-2018-15695
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path traversal vulnerability in wallpaper.cgi...
PT-2018-5427
Name of the Vulnerable Software and Affected Versions: PLANEX CS-W50HD devices with firmware before 030720 Description: A command-injection issue exists in the web management UI on the NAS settings page "/cgi-bin/nasset.cgi". An attacker can send a crafted HTTP POST request to execute arbitrary...
CVE-2017-12573: Undefined Security Weakness
An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. The device has a command-injection vulnerability in the web management UI on NAS settings page "/cgi-bin/nasset.cgi". An attacker can send a crafted HTTP POST request to execute arbitrary code. Authentication is...
ireland-information.com XSS vulnerability
Open Bug Bounty ID: OBB-668034 Description| Value ---|--- Affected Website:| ireland-information.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
