CVE-2017-6087

EyesOfNetwork "EON" 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selectedevents parameter in the 1 acknowledge, 2 delete, or 3 ownDisown function in module/monitoringged/gedfunctions.php or the 4 module parameter to module/index.php...

CVE-2017-6087: Improper Neutralization of Special Elements used in an OS Command

EyesOfNetwork "EON" 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selectedevents parameter in the 1 acknowledge, 2 delete, or 3 ownDisown function in module/monitoringged/gedfunctions.php or the 4 module parameter to module/index.php...

PT-2017-16886

Name of the Vulnerable Software and Affected Versions EyesOfNetwork versions 5.0 and earlier Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected events parameter. This can occur in the acknowledge, delete, or ownDisown functio...

Wonder CMS Path Traversal Vulnerability

Wonder CMS is an open source content management system CMS. A directory traversal vulnerability exists in the index.php file in Wonder CMS version 2014. A remote attacker can exploit this vulnerability to read arbitrary files with the help of a specially crafted theme...

Directory traversal

Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme...

CVE-2014-8704

Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme...

PT-2017-6702

Name of the Vulnerable Software and Affected Versions qdPM version 8.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including the searchkeywords parameter to "index.php/users" page, the "Name of application" on...

PT-2017-6701

Name of the Vulnerable Software and Affected Versions qdPM version 8.3 Description The issue allows remote attackers to obtain sensitive information. This is achieved by providing an invalid ID value to the "index.php/users/info/id/ID" endpoint, which results in an error message that reveals the...

CVE-2015-3882: Exposure of Sensitive Information to an Unauthorized Actor

qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/ID, which reveals the installation path in an error message...

PT-2017-6261

Name of the Vulnerable Software and Affected Versions Wonder CMS version 2014 Description A directory traversal issue in index.php allows remote attackers to include and execute arbitrary local files by crafting a theme. Recommendations For Wonder CMS version 2014, consider restricting access to...

CVE-2015-3883: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the 1 searchkeywords parameter to index.php/users page; the 2 "Name of application" on index.php/configuration; 3 a new project name on index.php/projects; 4 the task na...

PT-2017-17023

Name of the Vulnerable Software and Affected Versions TYPO3 version 7.6.15 Description The issue allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields. This occurs when TYPO3 sends an HTTP request to an...

CVE-2017-6370: Cleartext Transmission of Sensitive Information

TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields...

CVE-2014-8704: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme...

CVE-2017-6907

An issue was discovered in Open.GL before 2017-03-13. The vulnerability exists due to insufficient filtration of user-supplied data content passed to the "Open.GL-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...

PT-2017-17407

Name of the Vulnerable Software and Affected Versions Open.GL versions prior to 2017-03-13 Description The issue exists due to insufficient filtration of user-supplied data passed to the "Open.GL-master/index.php" URL. This allows an attacker to execute arbitrary HTML and script code in a browser...

CVE-2017-6907: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open.GL before 2017-03-13. The vulnerability exists due to insufficient filtration of user-supplied data content passed to the "Open.GL-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...

CVE-2017-6909: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Shimmie = 2.5.1. The vulnerability exists due to insufficient filtration of user-supplied data log passed to the "shimmie2-master/ext/chatbox/history/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable...

PT-2017-17409

Name of the Vulnerable Software and Affected Versions Shimmie versions prior to 2.5.1 Description The issue is caused by insufficient filtration of user-supplied data passed to the "shimmie2-master/ext/chatbox/history/index.php" URL, allowing an attacker to execute arbitrary HTML and script code ...

CVE-2017-6909

An issue was discovered in Shimmie = 2.5.1. The vulnerability exists due to insufficient filtration of user-supplied data log passed to the "shimmie2-master/ext/chatbox/history/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable...