PT-2017-14548 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.4-15217 Synology DiskStation Manager DSM versions prior to 6.0.3-8754-6 Description: An improper access control issue in synodsmnotify allows local users to inject arbitrary web script or...

jurefs-fn-ltk-rv.de XSS vulnerability

Open Bug Bounty ID: OBB-456252 Description| Value ---|--- Affected Website:| jurefs-fn-ltk-rv.de Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

CVE-2017-17651

Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter...

Sql injection

Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter...

CVE-2017-17651

Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter...

CVE-2014-4940: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Tera Charts tera-charts plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. dot dot in the fn parameter to 1 charts/treemap.php or 2 charts/zoomabletreemap.php...

CVE-2010-2626: Improper Control of Generation of Code

index.pl in Miyabi CGI Tools SEO Links 1.02 allows remote attackers to execute arbitrary commands via shell metacharacters in the fn command. NOTE: some of these details are obtained from third party information...

Unfixed XSS vulnerability at www.fn-franchecomte.com

Security researcher Xylitol, has submitted on 06/10/2009 a cross-site-scripting XSS vulnerability affecting www.fn-franchecomte.com, which at the time of submission ranked 19257728 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/12/2011. It ...

CVE-2008-4622: Improper Authentication

The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and gain administrative access by setting the fn-loggedin cookie to 1...

CVE-2008-4622

The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and gain administrative access by setting the fn-loggedin cookie to 1...

Cross site scripting

Cross-site scripting XSS vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to inject arbitrary web script or HTML via 1 the fn parameter during a dload action, 2 the mask parameter during a search action, and 3 the tab parameter during a sysinfo...

CVE-2008-4447: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to inject arbitrary web script or HTML via 1 the fn parameter during a dload action, 2 the mask parameter during a search action, and 3 the tab parameter during a sysinfo...

Sql injection

SQL injection vulnerability in index.php in ExoPHPdesk allows remote attackers to execute arbitrary SQL commands via the user parameter in a profile fn action...

CVE-2007-5991

SQL injection vulnerability in index.php in ExoPHPdesk allows remote attackers to execute arbitrary SQL commands via the user parameter in a profile fn action...

CVE-2007-5991: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in ExoPHPdesk allows remote attackers to execute arbitrary SQL commands via the user parameter in a profile fn action...

CVE-2006-6139

CVE-2006-6139 is a directory traversal vulnerability in the downloadexcel.php component of Sisfo Kampus 2006 (Semarang 3). It allows remote attackers to read arbitrary files via the fn parameter. This description is supported by NVD/CVE records; exploitation status is not provided in the document...

CVE-2006-6139: Undefined Security Weakness

Directory traversal vulnerability in downloadexcel.php in Sisfo Kampus 2006 Semarang 3 allows remote attackers to read arbitrary files via the fn parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2002-1698: Undefined Security Weakness

Buffer overflow in Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service crash via a long FN font argument in the message header...

CVE-2005-0479: Undefined Security Weakness

Directory traversal vulnerability in ComGetLogFile.php3 for TrackerCam 5.12 and earlier allows remote attackers to read arbitrary files via ".." sequences and 1 "/" slash, 2 "" backslash, or 3 hex-encoded characters in the fn parameter...

CVE-2005-0481: Undefined Security Weakness

TrackerCam 5.12 and earlier allows remote attackers to read log files via the fn parameter in a direct request to the ComGetLogFile.php3 script...