3319 matches found
CVE-2019-16925
Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change th...
CVE-2019-16925
CVE-2019-16925 affects Flower 0.9.3, with an XSS vulnerability reported via the name parameter in an @app.task call. The core issue appears to be unvalidated client-side data in the Flower web interface, but multiple sources note the project author disputes the vulnerability’s validity and emphas...
PT-2019-14872 · Celery · Flower
Name of the Vulnerable Software and Affected Versions: Flower version 0.9.3 Description: The issue concerns a potential XSS via the name parameter in an @app.task call. However, the project author disputes the validity of this issue, stating that worker and task names are internal backend...
PT-2019-7754 · WordPress · Colorway
Name of the Vulnerable Software and Affected Versions: Colorway theme versions prior to 3.4.2 for WordPress Description: The issue concerns a Cross-Site Scripting XSS problem. It is related to the contactName parameter. There is no information provided about the estimated number of potentially...
PT-2019-7755 · WordPress · Icegram
Name of the Vulnerable Software and Affected Versions: icegram plugin versions prior to 1.9.19 Description: The issue concerns a CSRF vulnerability via the option name parameter in the "wp-admin/edit.php" endpoint. This allows for potential unauthorized actions. Recommendations: For versions prio...
CVE-2019-14747
DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter...
PT-2019-12511 · Synology · Synology Moments
Name of the Vulnerable Software and Affected Versions: Synology Moments versions prior to 1.3.0-0691 Description: The issue concerns a relative path traversal vulnerability. It allows remote authenticated users to upload arbitrary files via the name parameter. Recommendations: For versions prior ...
CVE-2017-8329
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of setting a name for the wireless network. These values are stored by the device in NVRAM Non-volatile RAM. It seems that the POST parameters passed ...
CVE-2019-11226
CMS Made Simple 2.2.10 has XSS via the m1name parameter in "Add Article" under Content - Content Manager - News...
HPE Intelligent Management powershellConfigContent Code Execution Vulnerability
HPE Intelligent Management Center is a suite of network intelligence management center solutions. A code execution vulnerability exists in the handling of the HPE Intelligent Management Center powershellConfigContent beanName parameter, which can be exploited by an attacker to submit a special...
CVE-2016-10758
PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and pkinc/func/default.php via the imagename parameter...
CVE-2018-18276
XSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating a new folder in the administrative panel...
YzmCMS Cross-Site Scripting Vulnerability (CNVD-2019-07929)
YzmCMS is an open source CMS Content Management System by Yuan Zhimeng programmers in China. A cross-site scripting vulnerability exists in YzmCMS version 5.2. A remote attacker can use the 'column name' parameter of admin/category/edit.html page to inject arbitrary Web script or HTML with the he...
SQL Injection Vulnerability at the login of Central Message Board v3.2
Central Message Board is an online message system developed by Central Studio using oop. Azeus Message Board v3.2 SQL injection vulnerability exists at the login. Azeus Message Board v3.2 fails to filter the name parameter in the background login, allowing attackers to exploit the vulnerability f...
baigo CMS Cross-Site Scripting Vulnerability
baigo CMS is a PHP-based open source web content management system. A cross-site scripting vulnerability exists in baigo CMS 2.1.1. A remote attacker can use this vulnerability to inject arbitrary Web script or HTML via the optbaseBGSITENAME parameter of the bgconsole/index.php?m=opt&c=request UR...
CVE-2019-9226
An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the optbaseBGSITENAME parameter to the bgconsole/index.php?m=opt&c=request URI...
MOPCMS Cross-Site Scripting Vulnerability
MOPCMS is a content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in MOPCMS 2018-11-30 and earlier versions, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'formname' parameter...
Zoho ManageEngine OpManager SQL Injection (CVE-2018-17823; CVE-2018-17283)
An SQL injection vulnerability exists in ManageEngine. This vulnerability is due to insufficient validation of the name parameter when processing requests sent. Successful exploitation could lead to arbitrary SQL code execution in the security context of database service...