CVE-2017-12740

Siemens LOGO! Soft Comfort All versions before V8.2 lacks integrity verification of software packages downloaded via an unprotected communication channel. This could allow a remote attacker to manipulate the software package while performing a Man-in-the-Middle MitM attack...

Code injection

Siemens LOGO! Soft Comfort All versions before V8.2 lacks integrity verification of software packages downloaded via an unprotected communication channel. This could allow a remote attacker to manipulate the software package while performing a Man-in-the-Middle MitM attack...

CVE-2017-12740

Siemens LOGO! Soft Comfort All versions before V8.2 lacks integrity verification of software packages downloaded via an unprotected communication channel. This could allow a remote attacker to manipulate the software package while performing a Man-in-the-Middle MitM attack...

CVE-2017-12740

CVE-2017-12740 affects Siemens LOGO! Soft Comfort (all versions before V8.2). The vulnerability stems from lack of integrity verification for software packages downloaded through an unprotected channel, enabling a remote attacker to manipulate packages via a MITM attack. Impact is remote manipula...

Siemens LOGO! Soft Comfort Man-in-the-Middle Attack Vulnerability

LOGO! Soft Comfort is a Siemens LOGO! programming software that supports the addition of text display modules. A man-in-the-middle attack vulnerability exists in Siemens LOGO! Soft Comfort due to a lack of integrity validation of downloaded packages in Soft Comfort, the update center for LOGO!,...

Siemens LOGO! Soft Comfort

CVSS v3 5.9 ATTENTION: Remotely exploitable. Vendor: Siemens Equipment: LOGO! Soft Comfort Vulnerability: Download of Code without Integrity Check AFFECTED PRODUCTS Siemens reports that the vulnerability affects the following LOGO! Soft Comfort engineering software products: LOGO! Soft Comfort: A...

CVE-2017-17730

DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flinkadd.php...

Sql injection

DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flinkadd.php...

CVE-2017-17730

DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flinkadd.php...

NiuShop open source mall system v1.21 file upload vulnerability

NiuShop open source mall system is by Shanxi Niu Cool Information Technology Co., Ltd. completely independent design, research and development of a set of PHP open source e-commerce system . NiuShop open source mall system v1.21 file upload vulnerability exists. The vulnerability is due to the...

Desdev DedeCMS SQL Injection Vulnerability

Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...

Cross-site Scripting (XSS)

October CMS is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the brand logo image name, allowing a malicious user to inject and execute arbitrary Javascript...

CVE-2017-1000193

October CMS build 412 is vulnerable to stored WCI a.k.a XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...

CVE-2017-1000193

October CMS build 412 is vulnerable to stored WCI a.k.a XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...

CVE-2017-1000193

October CMS build 412 is vulnerable to stored WCI a.k.a XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...

CVE-2017-1000193

October CMS 412 is reported to be vulnerable to a stored XSS (WCI) via the brand logo image name, allowing injected JavaScript to execute in the victim’s browser. The root cause, as described in the connected materials, is a stored XSS flaw in the brand logo handling. The documents do not specify...

October CMS Cross-Site Scripting Vulnerability (CNVD-2017-37277)

OctoberCMS is a CMS system based on Laravel PHP development framework. A cross-site scripting vulnerability exists in the brand logo image name in October CMS build 412. An attacker can exploit this vulnerability to execute JavaScript code in the victim's browser...

SolarWinds Network Performance Monitor Denial of Service Vulnerability

SolarWinds Network Performance Monitor NPM is a network performance monitor from SolarWinds, Inc. that provides monitoring and reporting, tracking of up/down status, real-time analytics, and network performance statistics for routers, virtualized environments, and other devices. A security...

Infogram: Stored XSS in the Custom Logo link (non-Basic plan required)

Description Hello. Recently i contacted with Infogram, and requested trial of the Business version to test some features, which was unavailable in the Basic version. I discovered the stored cross-site scripting issue in the Custom Logo link. F232084 There was some URL checks in place, but i was...

CVE-2017-9538

The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service permanent display of a "Cannot exit above the top directory" error message throughout the entire web application via a ".." in the pat...