PT-2019-8912

Name of the Vulnerable Software and Affected Versions Eventum version 3.5.0 Description An issue was discovered that allows CSRF in the htdocs/manage/users.php file, enabling the creation of another user with admin privileges. Recommendations For Eventum version 3.5.0, update to a newer version...

PT-2019-8911

Name of the Vulnerable Software and Affected Versions Eventum version 3.5.0 Description An issue was discovered in the software, where the /htdocs/list.php endpoint has a cross-site scripting XSS issue via the show notification list issues or show authorized issues parameters. Recommendations For...

PT-2019-8907

Name of the Vulnerable Software and Affected Versions Eventum version 3.5.0 Description An issue was discovered in the htdocs/switch.php file, where there is a cross-site scripting XSS vulnerability via the current page parameter. This allows for potential malicious script execution...

PT-2019-8910

Name of the Vulnerable Software and Affected Versions Eventum version 3.5.0 Description An issue was discovered in the software, where the /htdocs/popup.php endpoint has a cross-site scripting XSS vulnerability via the cat parameter. This allows for potential malicious script execution...

PT-2019-8906

Name of the Vulnerable Software and Affected Versions Eventum version 3.5.0 Description An issue was discovered in the software, where the htdocs/ajax/update.php endpoint has a cross-site scripting XSS vulnerability via the field name parameter. Recommendations For Eventum version 3.5.0, avoid...

CVE-2018-12623: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Eventum 3.5.0. htdocs/switch.php has XSS via the currentpage parameter...

PT-2019-8909

Name of the Vulnerable Software and Affected Versions Eventum version 3.5.0 Description An issue was discovered in the software, where the /htdocs/validate.php endpoint has a cross-site scripting XSS vulnerability via the values parameter. Recommendations For Eventum version 3.5.0, consider...

PT-2019-13314

Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns an incomplete factory-reset process implemented by /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on the affected device. This incompleteness c...

Open redirect

An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...

CVE-2018-12621

An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...

CVE-2018-12621

CVE-2018-12621 affects Eventum 3.5.0 with an Open Redirect in /htdocs/switch.php via the current_page parameter. The issue enables redirection to arbitrary URLs. No explicit remediation or patch version is provided in the connected documents; details about exploit availability or mitigations are ...

CVE-2018-12621

An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...

PT-2019-8905

Name of the Vulnerable Software and Affected Versions Eventum version 3.5.0 Description An issue was discovered in the software, where the /htdocs/switch.php file has an Open Redirect via the current page parameter. Recommendations For version 3.5.0, consider restricting access to the...

CVE-2018-12624

An issue was discovered in Eventum 3.5.0. /htdocs/postnote.php has XSS via the garlicprefix parameter...

PT-2019-8908

Name of the Vulnerable Software and Affected Versions Eventum version 3.5.0 Description An issue was discovered in the software, where the /htdocs/post note.php endpoint has a cross-site scripting XSS issue via the garlic prefix parameter. Recommendations For Eventum version 3.5.0, avoid using th...

CVE-2018-13983

ImpressCMS 1.3.10 has XSS via the PATHINFO to htdocs/install/index.php, htdocs/install/pagelangselect.php, or htdocs/install/pagemodcheck.php...

CVE-2018-13983

ImpressCMS 1.3.10 is affected by an XSS vulnerability triggered via PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheck.php. The root cause is unvalidated PATH_INFO leading to cross-site scripting, enabling arbitrary HTML/JS execution in a us...

CVE-2018-13983: Improper Neutralization of Input During Web Page Generation

ImpressCMS 1.3.10 has XSS via the PATHINFO to htdocs/install/index.php, htdocs/install/pagelangselect.php, or htdocs/install/pagemodcheck.php...

PT-2019-9012

Name of the Vulnerable Software and Affected Versions ImpressCMS version 1.3.10 Description The issue concerns a cross-site scripting XSS problem. It occurs via the PATH INFO to specific endpoints, including "htdocs/install/index.php", "htdocs/install/page langselect.php", or "htdocs/install/page...

CVE-2018-10108: Improper Neutralization of Input During Web Page Generation

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have XSS in the Treturn parameter to /htdocs/webinc/js/bscsmsinbox.php...