The vulnerability of the request handler of the NVBUSourceDeviceSet Get function in the software for data archiving and restoration by NetVault Backup allows a attacker to execute arbitrary code.

The vulnerability of the NVBUSourceDeviceSet Get request handler in software for data archiving and restoration in NetVault Backup is related to insufficient protection of the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability in the web server of the SyncBreeze file synchronization software, the DupScout file duplication detection software, the DiskSavvy disk space analyzer, and the DiskPulse logical disk change monitoring software allows a malicious actor to gain access to the system with NT AUTHORITY/SYSTEM privileges.

The vulnerability of the web server software for synchronizing SyncBreeze files, the software for detecting file duplicates DupScout, the disk space analyzer DiskSavvy, and the software for monitoring changes on hard drives DiskPulse is caused by buffer overflows. Exploiting this vulnerability ca...

Ping Identity: CSRF in Inviting users

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: add summary of the vulnerabili...

CVE-2018-5467

CVE-2018-5467 affects Belden Hirschmann Classic Platform Switches (RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, OCTOPUS all versions). It is an Information Exposure Through Query Strings in GET Request vulnerability in the web interface, potentially enabling an attacker to impersonate a legitim...

CVE-2018-5467: Use of GET Request Method With Sensitive Query Strings

An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An information exposure through query strings vulnerability in the web interface has been identified, which...

PT-2018-3424

Name of the Vulnerable Software and Affected Versions: Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches affected versions not specified Description: An issue was discovered in the web interface of the affected switches, related to information...

CVE-2017-9280 Novell Identity Manager User Application get request url contains the session token.

Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions to untrusted third parties via proxies, referer urls or similar...

CVE-2017-9280: Use of GET Request Method With Sensitive Query Strings

Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions to untrusted third parties via proxies, referer urls or similar...

Lutron Quantum BACnet Integration Devices Information Disclosure Vulnerability

Lutron Quantum BACnet Integration device is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

WP Fastest Cache <= 0.8.7.4 - Blind SQL Injection

Improper escaping of user input when deleting the cache of specific pages leads to SQL injection vulnerability. escsql was used on input but the result was used unquoted in the constructed SQL query. Send GET request to "URL/wp-admin/admin-ajax.php?action=wpfcclearcachecolumn&id=1 PAYLOAD"...

CVE-2018-1000053

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery CSRF vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be us...

CVE-2018-1000053

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery CSRF vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be us...

Cross site request forgery (csrf)

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery CSRF vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be us...

CVE-2018-1000053

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery CSRF vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be us...

CVE-2018-1000053: Cross-Site Request Forgery (CSRF)

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery CSRF vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be us...

Geovision Inc. IP Camera Remote Detection

Detection of running version of Geovision Inc. IP Camera. This script sends an HTTP GET request and tries to ensure the presence of Geovision Inc. IP Camera. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

CVE-2017-1000401

The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, , supports form validation e.g. for API keys. The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations o...

Multiple Products Web Server Component Privilege Gain Vulnerability

Dup Scout Enterprise is a file wiping tool.Disk Savvy Enterprise is a hard disk space analysis tool.Sync Breeze Enterprise is a file synchronization tool.Disk Pulse Enterprise is a disk inspection tool. A security vulnerability exists in the web server component of multiple products that stems fr...

CVE-2017-13696

A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 where an attacker can craft a malicious GET request and exploit the web server component. Successful...

D-Link DSL-2640U and DSL-2540U Remote Code Execution Vulnerability

The D-Link DSL-2640U and DSL-2540U are both router products from AUO D-Link. A remote code execution vulnerability exists in the diagping.cmd file in D-Link DSL-2640U devices with firmware versions IM1.00 and ME1.00 and DSL-2540U devices with firmware version ME1.00. A remote attacker can exploit...