PAYFORT payfort-php-SDK cross-site scripting vulnerability (CNVD-2019-08574)

PayFort is an online payment gateway. payfort-php-SDK is the PayFort payment gateway SDK. A cross-site scripting vulnerability exists in Amazon PAYFORT payfort-php-SDK on 2018-04-26 and earlier versions, which can be exploited by an attacker via the route.php paymentMethod parameter to conduct a...

CVE-2018-15169

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter...

CVE-2018-12996

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager before 13 Build 13800 allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do...

Active Record contains SQL Injection

SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in...

CVE-2017-12927: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php...

VirtueMart com_virtuemart component SQL injection vulnerability in Joomla!

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, it provides RSS feeds , site search and other features . VirtueMart comvirtuemart is one of the e-commerce components . A SQL injection vulnerability exists in version 3.0.14 of the Joomla!...

CVE-2017-8303

An issue was discovered on Accellion FTA devices before FTA912180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter...

PT-2017-18271

Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180 Description An issue allows remote code execution with shell metacharacters in the method parameter of the "seos/1000/find.api" API endpoint. Recommendations For versions prior to FTA 9 12 180, upda...

CVE-2017-8303: Improper Encoding or Escaping of Output

An issue was discovered on Accellion FTA devices before FTA912180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter...

CakePHP Security Bypass Vulnerability

CakePHP is the United States Cake Software Foundation of a MVC-based architecture , open source Web development framework. The framework has a flexible view caching , automatic generation of CRUD code and other features . A security vulnerability exists in CakePHP version 2.x and version 3.x befo...

UBUNTU-CVE-2015-8379

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the method parameter...

PT-2016-3898

Name of the Vulnerable Software and Affected Versions CakePHP versions 2.x through 3.1.4 Description The issue allows remote attackers to bypass the CSRF protection mechanism. This is achieved via the method parameter. Recommendations For CakePHP versions 2.x through 3.1.4, update to version 3.1....

Gentoo Security Advisory GLSA 201401-22

Gentoo Linux Local Security Checks GLSA 201401-22 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Spree controller Parameter Arbitrary Ruby Object Instantiation Command Execution

Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and executd arbitrary commands via the 1 paymentmethod parameter to core/app/controllers/spree/admin/ paymentmethodscontroller.rb; and the 2 promotionaction parameter to...

phpwind 7.5 api/class_base.php Include Vulnerabilities

PHPWind 论坛系统 是一套采用 php+mysql 数据库 方式运行并可生成 html 页面的全新且完善的强大系统。因具有非凡的访问速度和卓越的负载能力而深受国内外朋友的喜爱。 api/classbase.php文件里callback函数里$mode变量没有过滤导致任意包含本地文件,从而可以执行任意PHP命令. api/classbase.php文件里: function callback$mode, $method, $params if !isset$this-classdb$mode if !fileexistsRP.'api/class' . $mode . '.php'...

CVE-2006-1331: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in index.php in Noah's Classifieds 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 method or 2 list parameter...

CVE-2003-1088: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php for Zorum 3.4 and 3.5 allows remote attackers to inject arbitrary web script or HTML via the method parameter...

CVE-2003-0763: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Escapade Scripting Engine ESP allows remote attackers to inject arbitrary script via the method parameter, as demonstrated using the PAGE parameter...