988 matches found
CVE-2023-39617
TOTOLINK X5000RV9.1.0cu.2089B20211224 and X5000RV9.1.0cu.2350B20230313 were discovered to contain a remote code execution RCE vulnerability via the lang parameter in the setLanguageCfg function...
CVE-2023-45929
S-Lang 2.3.2 was discovered to contain a segmentation fault via the function fixuptgetstr...
CVE-2023-33559
A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file...
CVE-2022-41517
TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function...
CVE-2022-36482
TOTOLINK N350RT V9.3.5u.6139B20201216 was discovered to contain a command injection vulnerability via the lang parameter in the function setLanguageCfg...
CVE-2022-36462
TOTOLINK A3700R V9.1.2u.6134B20201202 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg...
CVE-2022-29307
IonizeCMS v1.0.8.1 was discovered to contain a command injection vulnerability via the function copylangcontent in application/models/langmodel.php...
CVE-2021-28845
Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service by sending the POST request to applycgi via the lang action without a language key...
CVE-2021-39368
Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang parameter...
CVE-2020-23171
A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in the name of the crafted file...
CVE-2020-22533
Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter...
CVE-2020-20589
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
CVE-2011-4950
Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...
CVE-2015-10058
A vulnerability, which was classified as problematic, was found in Wikisource Category Browser. This affects an unknown part of the file index.php. The manipulation of the argument lang leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named...
CVE-2015-1347
Cross-site scripting XSS vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...
CVE-2012-1671
Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...
CVE-2003-0061
Buffer overflow in passwd for HP UX B.10.20 allows local users to execute arbitrary commands with root privileges via a long LANG environment variable...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS via specifically crafted search templates with Mustache functions. An attacker can cause the Elasticsearch node to crash by sending malicious search templates. Details Denial of Service DoS describes a family of...
