CVE-2016-5236

Cross-Site-Scripting XSS vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account or signature...

CVE-2016-5236

CVE-2016-5236 affects F5 WebSafe Dashboard (3.9.5 and earlier). The vulnerability is a Cross-Site Scripting (XSS) flaw that enables a privileged authenticated user to inject arbitrary script/HTML when creating a new user, account, or signature. The F5 advisory lists vulnerable products/features a...

CVE-2016-5235

Summary of CVE-2016-5235 (F5 WebSafe Dashboard XSS) The vulnerability affects the F5 WebSafe Dashboard (WebSafe Alert Server) and is triggered by an unauthenticated user who can inject HTML via a crafted alert in versions 3.9.x and earlier. The advisory confirms an XSS flaw that can be exploited ...

CVE-2016-5236: Improper Neutralization of Input During Web Page Generation

Cross-Site-Scripting XSS vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account or signature...

PT-2019-7831

Name of the Vulnerable Software and Affected Versions F5 WebSafe Dashboard versions 3.9.x and earlier Description A Cross Site Scripting XSS issue allows an unauthenticated user to inject HTML via a crafted alert. This enables potential attackers to execute malicious scripts on the client-side...

PT-2019-7832

Name of the Vulnerable Software and Affected Versions F5 WebSafe Dashboard versions 3.9.5 and earlier Description The issue allows privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account, or signature. This is a Cross-Site-Scripting XSS vulnerabilit...

CVE-2016-5235: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an unauthenticated user to inject HTML via a crafted alert...

New Relic: Stored XSS via "my recent queries" selector in NRQL dashboard builder

This is a pretty simple one. Within NR One, there is a stored XSS via the dashboard builder. It appears in the "My recent queries" dropdown. You can attack other users with this bug by having them navigate to the link, I'll show an example below. Steps to Reproduce: 1. From NR1, navigate to the...

CVE-2018-17393: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in HealthNode Hospital Management System 1.0 via the id parameter to dashboard/Patient/info.php or dashboard/Patient/patientdetails.php...

PT-2019-9462

Name of the Vulnerable Software and Affected Versions HealthNode Hospital Management System version 1.0 Description The issue exists due to SQL Injection in the HealthNode Hospital Management System. This can be exploited via the id parameter to "dashboard/Patient/info.php" or...

CVE-2019-12530

Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh...

CVE-2019-12530

Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh...

Improper access control

Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh...

CVE-2019-12530

CVE-2019-12530 affects the stdonato Dashboard plugin for GLPI up to version 0.9.7. The issue is improper/access control in the plugin, impacting files in front/sh such as df.php, issue.php, load.php, mem.php, traf.php, and uptime.php. This results in a high-severity vulnerability with potential u...

CVE-2019-12530

Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh...

CVE-2019-12530

Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh...

CVE-2019-12530: Improper Authentication

Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh...

PT-2019-12839

Name of the Vulnerable Software and Affected Versions GLPI stdonato Dashboard plugin versions through 0.9.7 Description Incorrect access control was discovered in the stdonato Dashboard plugin for GLPI, affecting several PHP files in the front/sh directory, including df.php, issue.php, load.php,...

SQL Injection

Foreman is vulnerable to SQL injection. An input sanitization flaw in the id field in the dashboard controller allows remote unauthenticated attackers to perform SQL injection on the back end database...

CVE-2017-11559

An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack...