318 matches found
ASUSTOR ADM OS Command Injection Vulnerability (CNVD-2018-26932)
ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. An operating system command injection vulnerability exists in the user.cgi file in ASUSTOR ADM version 3.1.1, which can be exploited to execute system commands with root privileges using the 'secretkey' URL...
CVE-2018-12308
Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encryptkey" URL parameter...
SEMCMS Cross-Site Scripting Vulnerability (CNVD-2019-01725)
SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SEMCMS3.4 version of a cross-site scripting vulnerability, remote attackers can admin/SEMCMSCategories.php?pid=1&lgid=1 URI's 'categorykey ' parameter to take advantage of the vulnerability to inject...
PT-2018-14616
Name of the Vulnerable Software and Affected Versions SEMCMS version 3.4 Description A cross-site scripting XSS issue was found, allowing potential exploitation through the category key parameter in the "admin/SEMCMS Categories.php" endpoint, specifically when the parameters pid=1 and lgid=1 are...
CVE-2018-13818
Twig before 2.4.4 allows Server-Side Template Injection SSTI via the search searchkey parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it...
CVE-2018-13818
Twig before 2.4.4 allows Server-Side Template Injection SSTI via the search searchkey parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it...
PT-2018-12201 · Symfony · Twig
Name of the Vulnerable Software and Affected Versions: Twig versions prior to 2.4.4 Description: The issue allows Server-Side Template Injection SSTI via the search key parameter. It is noted that Twig itself is not a web application, and the responsibility of properly wrapping input to it lies...
PT-2018-11004
Name of the Vulnerable Software and Affected Versions LAMS versions prior to 3.1 Description The issue concerns unauthenticated reflected cross-site scripting XSS that allows a remote attacker to introduce arbitrary JavaScript. This is achieved through the manipulation of an unsanitized GET...
Impinj Speedway Connect R420 RFID Reader Cross-Site Scripting Vulnerability
Impinj Speedway Connect R420 RFID Reader is an identifier used to identify and track objects from Impinj USA. A cross-site scripting vulnerability exists in the 'license key' parameter of the web application in Impinj Speedway Connect R420 RFID Reader versions prior to 2.2.2. A remote attacker...
CVE-2018-5303: Improper Neutralization of Input During Web Page Generation
An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The license key parameter of the web application is vulnerable to Cross Site Scripting; this vulnerability allows an attacker to send malicious code to another user...
Atlassian Confluence Server Cross-Site Scripting Vulnerability (CNVD-2018-03443)
Atlassian Confluence Server is a suite of professional enterprise knowledge management and collaboration software from Atlassian Australia, which can also be used to build an enterprise WiKi. the software enables collaboration and knowledge sharing amongst team members. A cross-site scripting...
PT-2018-6664
Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server versions prior to 6.6.1 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability. This is achieved through the key parameter in the...
CVE-2017-18085: Improper Neutralization of Input During Web Page Generation
The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the key parameter...
SugarCRM 3.5.1 Cross Site Scripting
Exploit Title: sugarCRM 3.5.1 XSS refeclted Date: 16/01/2017 Exploit Author: Guilherme Assmann Vendor Homepage: https://www.sugarcrm.com/ Version: 3.5.1 Tested on: kali linux, windows 7, 8.1, 10, ubuntu - Firefox Download...
SugarCRM 3.5.1 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: sugarCRM 3.5.1 XSS refeclted Date: 16/01/2017 Exploit Author: Guilherme Assmann Vendor Homepage: https://www.sugarcrm.com/ Version: 3.5.1 Tested on: kali linux, windows 7, 8.1, 10, ubuntu - Firefox Download...
Trustwave Secure Web Gateway Elevation of Privilege Vulnerability
Trustwave Secure Web Gateway SWG is a web security gateway product from Trustwave, Inc. A security vulnerability exists in Trustwave SWG version 11.8.0.27 and earlier. A remote attacker can exploit the vulnerability by sending the 'publicKey' parameter to the /sendKey URI to add an arbitrary publ...
CVE-2017-17598
Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter...
CVE-2017-17598
Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter...
