CVE-2019-1010199

ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting XSS. The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side...

Cross site scripting

ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting XSS. The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side...

CVE-2019-1010199

ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting XSS. The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side...

CVE-2019-1010246

MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure e.g. username, password. The component is: The API call in the function allowAction in...

CVE-2019-1010246

MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure e.g. username, password. The component is: The API call in the function allowAction in...

CVE-2019-1010246

CVE-2019-1010246 affects MailCleaner prior to c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9. The vulnerability is an unauthenticated disclosure of MySQL password information via the API call in the function allowAction() in NewslettersController.php, exploitable through an HTTP GET request. Impact is ...

The vulnerability of the web interface of the SIP phone Yealink SIP-T21P E2, related to insufficient access control checks, allows a perpetrator to gain access to configuration files.

The vulnerability of the web interface of the SIP phone Yealink SIP-T21P E2 is related to insufficient verification of access rights. Exploiting this vulnerability can allow an attacker to gain access to configuration files through a specially crafted GET request...

Nortek Security & Control Linear eMerge E3-Series License Issue Vulnerability

The Nortek Security & Control Linear eMerge E3-Series is an access control device from Nortek Security & Control USA. Nortek Security & Control Linear eMerge E3-Series is vulnerable to an authorization issue. An attacker can use this vulnerability to bypass authorization with a GET request, obtai...

TP-Link Wi-Fi extender remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

WiFi extender can enlarge the WiFi signal, mainly used for large or multi-storey residential, and the router signal can not cover the family's case. The extender's principle is from the main router to get a WiFi signal, and broadcast channel other WiFi signal weak or no signal area. IBM X-Force...

Directory Traversal in lactate

A crafted GET request can be leveraged to traverse the directory structure of a host using the lactate web server package, and request arbitrary files outside of the specified web root. This allows for a remote attacker to gain access to arbitrary files on the filesystem that the process has acce...

The vulnerability in the “One Portal for Housing Fund Monitoring” platform, related to insufficient verification of access rights, allows a violator to gain access to protected information.

The vulnerability in the “One Portal for Housing Fund Monitoring” platform is related to insufficient verification of access rights. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information through a specially crafted GET request...

VulnCheck KEV: CVE-2010-5330

Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi...

Command injection

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi aka Show AP info because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSyn...

CVE-2010-5330

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi aka Show AP info because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSyn...

CVE-2010-5330

CVE-2010-5330 covers a command injection in Ubiquiti devices via GET to stainfo.cgi. The issue arises because the ifname parameter is not sanitized, enabling shell metacharacters to be injected. Affected families include Ubiquiti AirOS (before 4.0.1), AirMax ISP products (before 5.3.5), and AirSy...

CVE-2010-5330

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi aka Show AP info because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSyn...

phpMyAdmin 4.8 Cross Site Request Forgery

Exploit Title: Cross Site Request Forgery CSRF Date: 11 June 2019 Exploit Author: Riemann Vendor Homepage: https://www.phpmyadmin.net/ Software Link: https://www.phpmyadmin.net/downloads/ Version: 4.8 Tested on: UBUNTU 16.04 LTS -Installed Docker image - docker pull phpmyadmin/phpmyadmin:4.8 CVE ...

phpMyAdmin 4.8 - Cross-Site Request Forgery

phpMyAdmin 4.8 - Cross-Site Request Forgery Exploit Title: Cross Site Request Forgery CSRF Date: 11 June 2019 Exploit Author: Riemann Vendor Homepage: https://www.phpmyadmin.net/ Software Link: https://www.phpmyadmin.net/downloads/ Version: 4.8 Tested on: UBUNTU 16.04 LTS -Installed Docker image ...

Design/Logic Flaw

An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Making concurrent GET /api/v4/projects//languages requests may allow Uncontrolled Resource Consumption...

CCSP 7.2.5 API XML Injection / Server-Side Request Forgery

!-- Exploit Title: Enghouse Interactive´s CCSP 7.2.5 API XXE and SSRF vulnerability via unauthenticated GET Request Date: 05-08-2018 Exploit Author: David Herrero Vendor Homepage: https://www.enghouseinteractive.com Software Link:...