85 matches found
WordPress Plugin WP Cerber Security: Cross-Site Script Vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
VulnCheck KEV: CVE-2016-5674
debuggingcenterutils.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter...
PT-2022-2555 · Amazon · Amazon Aws Client Vpn
Name of the Vulnerable Software and Affected Versions: Amazon AWS VPN Client version 2.0.0 Description: An issue exists in the Amazon AWS VPN Client, allowing parameters outside of the allow list to be injected into the configuration file. This can lead to an arbitrary file write as SYSTEM with...
VulnCheck KEV: CVE-2013-6720
Directory traversal vulnerability in download.php in the Passive Capture Application PCA web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to bypass intended access restrictions via a .. dot dot in the log parameter, as...
PT-2020-16725
Name of the Vulnerable Software and Affected Versions: Loginizer plugin versions prior to 1.6.4 Description: The Loginizer plugin for WordPress is susceptible to SQL injection, potentially leading to cross-site scripting XSS. The issue is related to the loginizer login failed and lz valid ip...
PT-2020-7781
Name of the Vulnerable Software and Affected Versions: Netsweeper versions 3.1.10 and earlier, 4.0.x through 4.0.8, 4.1.x through 4.1.1 Description: The issue allows remote attackers to list directory contents via a .. dot dot in the log parameter in a stats action. This is due to a directory...
CVE-2019-13079
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /adminui/historylog.php. The affected parameter is TYPENAME...
CVE-2019-13079
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /adminui/historylog.php. The affected parameter is TYPENAME...
Design/Logic Flaw
Web Port 1.19.1 allows XSS via the /log type parameter...
Code injection
debuggingcenterutils.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter...
CVE-2016-5674
debuggingcenterutils.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter...
CVE-2016-5674: Improper Input Validation
debuggingcenterutils.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter...
PT-2016-3421
Name of the Vulnerable Software and Affected Versions NUUO NVRmini versions 1.7.5 through 3.0.0 NUUO NVRsolo versions 1.7.5 through 3.0.0 NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1 Description The issue exists due to insufficient input validation in the debugging center utils .php...
Oracle NoSQL 11g 1.1.100 R2 - 'log' Parameter Directory Traversal Vulnerability
Exploit for java platform in category web applications source: http://www.securityfocus.com/bid/50567/info Oracle NoSQL is prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain...
PT-2014-6272
Name of the Vulnerable Software and Affected Versions Status2k affected versions not specified Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved by exploiting a SQL injection vulnerability in the admin/options/logs.php file via th...
CVE-2014-5089: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary SQL commands via the log parameter...
PT-2014-3173
Name of the Vulnerable Software and Affected Versions IBM Tealeaf CX versions 7.x, 8.x through 8.6, 8.7 through 8.7 before FP2, 8.8 through 8.8 before FP2 Description The issue allows remote authenticated users to bypass intended access restrictions via a .. dot dot in the log parameter of the...
CVE-2013-6720: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in download.php in the Passive Capture Application PCA web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to bypass intended access restrictions via a .. dot dot in the log parameter, as...