58 matches found
CVE-2024-26156: Improper Neutralization of Input During Web Page Generation
All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting XSS attacks in the method parameter. The ETIC RAS web server uses dynamic pages that gets their input from the client side and reflects the input in its response to the client...
phpscriptpoint RecipePoint SQL注入漏洞
RecipePoint is a SaaS multi-vendor recipe platform from the phpscriptpoint team. A SQL injection vulnerability exists in phpscriptpoint RecipePoint version 1.9, which stems from the parameter text/category/type/difficulty/cuisine/cookingmethod in the file /recipe-result that can lead to sql...
CVE-2020-20545
Cross-Site Scripting XSS vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the 'method' parameter to 'seeyon/hrSalary.do'...
CVE-2020-20545: Improper Neutralization of Input During Web Page Generation
Cross-Site Scripting XSS vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the 'method' parameter to 'seeyon/hrSalary.do'...
PT-2021-10505
Name of the Vulnerable Software and Affected Versions: Zhiyuan G6 Government Collaboration System version V6.1SP1 Description: The issue is related to a Cross-Site Scripting XSS vulnerability. It can be exploited via the method parameter to the "seeyon/hrSalary.do" endpoint. This allows for...
Zhiyuan G6 Government Collaboration System 跨站脚本漏洞
Zhiyuan G6 Government Collaboration System is an application system of China Zhiyuan Company. It is used to connect and integrate front-end and back-end scenario-based business applications. A cross-site scripting vulnerability exists in Zhiyuan G6 Government Collaboration System V6.1SP1, which...
openSUSE Security Update : python (openSUSE-2020-1859)
This update for python fixes the following issues : - bsc1177211 CVE-2020-26116 no longer allowing special characters in the method parameter of HTTPConnection.putrequest in httplib, stopping injection of headers. This update was imported from the SUSE:SLE-15:Update update project. C Tenable...
Security update for python (moderate)
openSUSE Security Update: Security update for python Announcement ID: openSUSE-SU-2020:1859-1 Rating: moderate References: 1177211 Cross-References: CVE-2020-26116 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for python...
Code injection
EyeSurfer BflyInstallerX.ocx v1.0.0.16 and earlier versions contain a vulnerability that could allow remote files to be download by setting the arguments to the vulnerable method. This can be leveraged for code execution. When the vulnerable method is called, they fail to properly check the...
NETGEAR Prosafe WC9500, WC7600 and WC7520 Operating System Command Injection Vulnerability
NETGEAR Prosafe WC9500 and others are a wireless controller for managing AP access points from NETGEAR. A security vulnerability exists in the NETGEAR Prosafe WC9500 version 5.1.0.17, WC7600 version 5.1.0.17, and WC7520 version 2.5.0.35. A remote attacker can exploit the vulnerability to execute...
PT-2019-7013
Name of the Vulnerable Software and Affected Versions node-connect versions prior to 2.8.1 Description The issue arises from the "methodOverride" middleware in Connect, which allows HTTP POST requests to override the method of the request using the method post key or the x-http-method-override...
PT-2019-13030
Name of the Vulnerable Software and Affected Versions WIKINDX versions prior to 5.8.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the method parameter in the noMenu and noSubMenu functions in core/navigation/MENU.php. Recommendations...
PT-2019-12411
Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance versions prior to 9.1 Description The issue concerns an unauthenticated reflected Cross-Site Scripting XSS vulnerability. It occurs when user-supplied input to the METHOD parameter in the /service/kbot...
CVE-2019-7661: Improper Neutralization of Input During Web Page Generation
An issue was discovered in PHPMyWind 5.5. The method parameter of the data/api/oauth/connect.php page has a reflected Cross-site Scripting XSS vulnerability...
PT-2019-18687
Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description A reflected Cross-site Scripting XSS issue was found. The issue is related to the "method" parameter of the "data/api/oauth/connect.php" page. Recommendations For PHPMyWind version 5.5, consider restricting...
Buffalo TS5600D1206 Access Control Error Vulnerability (CNVD-2019-00678)
The Buffalo TS5600D1206 is a network storage device from the Buffalo Group of Japan. An access control error vulnerability exists in the nasapi in the Buffalo TS5600D1206 version 3.61-0.10, which can be exploited by an attacker to call a dangerous internal function with the 'method' parameter...
CVE-2018-13321
Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter...
PT-2018-11745
Name of the Vulnerable Software and Affected Versions Buffalo TS5600D1206 version 3.61-0.10 Description The issue is related to incorrect access controls in the nasapi, allowing attackers to call internal functions. This can be achieved by manipulating the method parameter. Recommendations For...
CVE-2018-13321: Incorrect Permission Assignment for Critical Resource
Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter...