1196 matches found
Advantech WebAccess SCADA Password Parameter Buffer Overflow (CVE-2014-0992)
A stack buffer overflow exists in Advantech's WebAccess SCADA software. The vulnerability is due to insufficient input validation of the Password parameter in an ActiveX control that is part of the WebAccess Client. A remote, unauthenticated attacker could exploit this vulnerability by enticing a...
CVE-2012-5700
Multiple cross-site scripting XSS vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to admin/index.php or the 2 username or 3 password parameter in blocks/loginbox/loginbox.template.php to index.php. NOTE: some of thes...
CVE-2014-0992
Stack-based buffer overflow in Advantech WebAccess formerly BroadWin WebAccess 7.2 allows remote attackers to execute arbitrary code via the password parameter...
PT-2014-4005
Name of the Vulnerable Software and Affected Versions Advantech WebAccess version 7.2 Description A stack-based buffer overflow issue allows remote attackers to execute arbitrary code via the password parameter. Recommendations For Advantech WebAccess version 7.2, consider restricting access to t...
CVE-2014-0992: Improper Restriction of Operations within the Bounds of a Memory Buffer
Stack-based buffer overflow in Advantech WebAccess formerly BroadWin WebAccess 7.2 allows remote attackers to execute arbitrary code via the password parameter...
VirtuaStore 2.0 Password Parameter SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/18790/info VirtuaStore is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker to compromise the...
Anychart 3.0 Password Parameter SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/19330/info anychart is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful attack could allow an attacker to compromise the...
PT-2014-5818
Name of the Vulnerable Software and Affected Versions BarracudaDrive version 6.7.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be...
CVE-2014-4335: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in BarracudaDrive 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 host or 2 password parameter to rtl/protected/admin/ddns/...
CVE-2013-2047
The login page aka index.php in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password...
PT-2014-2540
Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.6 Description The issue concerns the login page, specifically the password parameter, where the autocomplete setting is not disabled. This makes it easier for physically proximate attackers to guess the password...
CVE-2012-0262
op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter...
CVE-2012-0262: Improper Control of Generation of Code
op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter...
PT-2013-1488
Name of the Vulnerable Software and Affected Versions op5 Monitor versions prior to 2.0.3 op5 Appliance versions prior to 5.5.3 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter. This can be exploited in the...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in admin/login in X3 CMS 0.4.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, 2 username, or 3 password parameter...
Session expiry pages may echo password in clear text
The "session expiry" and "XSRF token missing" pages will echo any submitted values. This may result in echoing the submitted password to the page in plain text if triggered on the WebSudo authentication page. Modify the error pages sessionexpired.jsp and xsrfmissing.jsp so they don't echo...
PT-2012-5160 · Pbboard · Pbboard
Name of the Vulnerable Software and Affected Versions: PBBoard version 2.1.4 Description: The issue allows remote attackers to change the password of arbitrary user accounts. This is achieved by exploiting the new password page, specifically through the member id and new password parameters to th...
PT-2012-3433
Name of the Vulnerable Software and Affected Versions e-ticketing affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands via the password parameter in the loginscript.php file. This can lead to unauthorized access and manipulation of databa...
CVE-2012-1673: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in loginscript.php in e-ticketing allows remote attackers to execute arbitrary SQL commands via the password parameter...
