CVE-2018-19089: Improper Neutralization of Input During Web Page Generation

tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/saverole name parameter, which is mishandled in tianti-module-admin\src\main\webapp\WEB-INF\views\user\userlist.jsp...

PT-2018-14803

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description The issue is related to reflected XSS in the user management module. It occurs via the userName parameter in the "tianti-module-admin/user/list" endpoint. Recommendations For version 2.3, consider restricting...

PT-2018-14801

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description The issue concerns a stored XSS in the userlist module. This occurs via the name parameter in the "tianti-module-admin/user/ajax/save role" endpoint, which is mishandled in the...

PT-2017-14259

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.1-0 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the group name parameter to the "module/admin group/add modify group.php" endpoint, specifical...

Cross site scripting

A persistent stored XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the hosts array parameter to module/admindevice/index.php...

PT-2017-13880

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.1-0 Description A persistent XSS issue in the EyesOfNetwork web interface allows remote authenticated administrators to inject arbitrary web script or HTML via the hosts array parameter to the "module/admin...

PT-2017-13803

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.1-0 Description The issue is related to a cross-site scripting XSS vulnerability in the EyesOfNetwork web interface. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the bp...

PT-2017-13802

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.1-0 Description A cross-site scripting XSS issue exists in the EyesOfNetwork web interface, allowing remote authenticated administrators to inject arbitrary web script or HTML. This can be achieved by manipulating the...

PT-2017-13445

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface aka eonweb version 5.1-0 Description The issue is related to a lack of input validation in include/function.php, which allows SQL injection via the user name parameter to the "ACCOUNT CREATION" section in module/adm...

PT-2017-13448

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface aka eonweb versions 5.1-0 Description The issue allows remote command execution via shell metacharacters in a hosts cacti array parameter to the "module/admin device/index.php" API endpoint. Recommendations For...

PT-2017-13446

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface aka eonweb version 5.1-0 Description The issue concerns SQL injection via the term parameter to the "module/admin group/search.php" API endpoint. Recommendations For EyesOfNetwork web interface aka eonweb version...

PT-2017-13096

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface aka eonweb versions 5.1-0 Description The issue allows directory traversal attacks, enabling the reading of arbitrary files. This is achieved via the file parameter in the module/admin conf/download.php API endpoint...

FreePBX 2.9.0.6 Shell Upload

==== Alligator Security Team =============================================== FreePBX - Module Administration Arbitrary File Upload Members: Tiago Ferreira ==== Table of Contents ===================================================== 1. Overview 2. Detailed description 3. Other Contexts & Solutions...