PT-2018-18715 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.6-15266 Description: A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the host parameter in the info.cgi...

Nagios XI Cross-Site Scripting Vulnerability (CNVD-2018-23143)

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A cross-site scripting vulnerability exists in Nagios XI 5.5.6. A remote, unauthenticated attacker can exploit this vulnerability via...

CVE-2018-15712

Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in apitool.php...

CVE-2018-15712

Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in apitool.php...

CVE-2018-15712

Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in apitool.php...

PT-2018-13162

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.5.6 Description The issue allows reflected cross-site scripting, which can be exploited by remote unauthenticated attackers. This is achieved via the host parameter in the "api tool.php" API endpoint. Recommendations For...

CVE-2018-15712: Improper Neutralization of Input During Web Page Generation

Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in apitool.php...

LAOBANCMS Arbitrary PHP Code Execution Vulnerability

Laoban CMS LAOBANCMS content management system is based on PHP + MYSQL environment developed by the old class of open-source website building system . LAOBANCMS 2.0 has an arbitrary PHP code execution vulnerability. Remote attackers can install/ URI through the host parameter to exploit the...

Code injection

An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI...

CVE-2018-19220

An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI...

CVE-2018-19220: Improper Control of Generation of Code

An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI...

PT-2018-14873

Name of the Vulnerable Software and Affected Versions LAOBANCMS version 2.0 Description An issue allows remote attackers to execute arbitrary PHP code via the host parameter to the "install/" URI. Recommendations For LAOBANCMS version 2.0, consider restricting access to the install/ URI to minimi...

CVE-2017-14445

An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to...

CVE-2017-14445: Buffer Copy without Checking Size of Input

An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to...

PT-2018-5646 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: A buffer overflow issue exists due to the incorrect handling of the host parameter by the HTTP server implementation during a firmware update request. This leads to a buffer overflow on a global section. ...

BSA-2018-604

Security Advisory ID : BSA-2018-604 Component : System Revision : 1.0: Final Multiple GPON Home Routers could allow a remote attacker to execute arbitrary commands on the system, caused by the ping and trace route commands running at root level on the diagnostic page. An attacker could exploit th...

PT-2018-2613

Name of the Vulnerable Software and Affected Versions Dasan GPON Routers affected versions not specified Description An issue was discovered on Dasan GPON home routers where Command Injection can occur via the dest host parameter in a "diag action=ping" request to a "GponForm/diag Form" URI. The...

Microsoft HeartbeatCtl ActiveX Code Execution

The vulnerability of the Microsoft HeartbeatCtl ActiveX control HRTBEAT.OCX in Internet Explorer is caused by buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the “Host” parameter...

EyesOfNetwork web interface 'host' parameter SQL injection vulnerability

EyesOfNetwork EON is an open source, free IT monitoring solution. The solution provides features such as a business process configuration tool, generating pop-up windows when events occur in the active queue, and more. The EyesOfNetwork web interface aka eonweb is one of these web interfaces...

CVE-2017-15933

SQL injection vulnerability vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the host parameter to module/capacityperdevice/index.php...