112 matches found
fn-landom.com.au Cross Site Scripting vulnerability OBB-1208377
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
PT-2019-18591
Name of the Vulnerable Software and Affected Versions Ericsson Active Library Explorer ALEX version 14.3 Description A security issue exists in the software, where an XSS issue is present in multiple parameters of the "/cgi-bin/alexserv" servlet. The affected parameters include DB, FN, fn, and id...
CVE-2019-7417: Improper Neutralization of Input During Web Page Generation
XSS exists in Ericsson Active Library Explorer ALEX 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB, FN, fn, or id parameter...
PT-2018-6398
Name of the Vulnerable Software and Affected Versions: gps-server.net GPS Tracking Software self hosted versions 2.x Description: The issue concerns a password reset procedure that allows immediate password resets upon an unauthenticated request. After the reset, an email is sent with a new,...
PT-2017-14548 · Synology · Synology Diskstation Manager
Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.4-15217 Synology DiskStation Manager DSM versions prior to 6.0.3-8754-6 Description: An improper access control issue in synodsmnotify allows local users to inject arbitrary web script or...
jurefs-fn-ltk-rv.de XSS vulnerability
Open Bug Bounty ID: OBB-456252 Description| Value ---|--- Affected Website:| jurefs-fn-ltk-rv.de Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...
PT-2017-14994
Name of the Vulnerable Software and Affected Versions Paid To Read Script version 2.0.5 Description The issue concerns an authentication bypass in the admin panel, which can be exploited via a direct request. Specifically, the fn parameter in the "admin/viewvisitcamp.php" endpoint and the uid...
CVE-2017-17651
Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter...
Sql injection
Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter...
CVE-2017-17651
Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter...
PT-2017-14943
Name of the Vulnerable Software and Affected Versions Paid To Read Script version 2.0.5 Description The issue concerns SQL Injection, which can be exploited via specific parameters in certain PHP files. The vulnerable parameters are uid in 'admin/userview.php', fnum in 'admin/viewemcamp.php', and...
CVE-2017-15235
The File Manager gollem module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename...
PT-2017-13924
Name of the Vulnerable Software and Affected Versions Horde Groupware version 5.2.21 with the File Manager gollem module 3.0.11 Description The issue allows remote attackers to bypass authentication for file downloads. This is achieved by using a crafted fn parameter that corresponds to the exact...
PT-2017-13680
Name of the Vulnerable Software and Affected Versions Simple Student Result plugin versions prior to 1.6.4 Description The issue allows for an authentication bypass because the fn ssr add st submit and fn ssr del st submit functions in functions.php only require knowledge of the student id number...
PT-2017-18696
Name of the Vulnerable Software and Affected Versions ImageWorsener version 1.3.1 Description The issue allows remote attackers to cause a denial of service, specifically an infinite loop, by providing a crafted image. This is due to a problem in the my skip input data fn function in imagew-jpeg....
CVE-2014-4940: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in Tera Charts tera-charts plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. dot dot in the fn parameter to 1 charts/treemap.php or 2 charts/zoomabletreemap.php...
PT-2014-6219
Name of the Vulnerable Software and Affected Versions Tera Charts tera-charts plugin version 0.1 for WordPress Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This is achieved by including a .. dot dot in the fn parameter ...
CVE-2010-2626: Improper Control of Generation of Code
index.pl in Miyabi CGI Tools SEO Links 1.02 allows remote attackers to execute arbitrary commands via shell metacharacters in the fn command. NOTE: some of these details are obtained from third party information...
Unfixed XSS vulnerability at www.fn-franchecomte.com
Security researcher Xylitol, has submitted on 06/10/2009 a cross-site-scripting XSS vulnerability affecting www.fn-franchecomte.com, which at the time of submission ranked 19257728 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/12/2011. It ...