18928 matches found
CVE-2018-8923
Cross-site scripting XSS vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments...
PT-2018-2074 · D Link · D-Link Central Wifi Manager
Name of the Vulnerable Software and Affected Versions: D-Link Central WiFi Manager versions prior to 1.03r0100-Beta1 Description: The issue is related to an unrestricted file upload vulnerability in the "onUploadLogPic" endpoint, which allows remote authenticated users to execute arbitrary PHP...
CVE-2018-8921
Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...
Cross site scripting
Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...
CVE-2018-8922
Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or folders via unspecified vectors...
CVE-2018-8921
Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...
CVE-2018-8922
CVE-2018-8922 affects Synology Drive prior to 1.0.2-10275. It is an improper access control vulnerability that lets remote authenticated users access non-shared files or folders via unspecified vectors. Multiple sources (NVD, CNVD, CVE list) corroborate this for Synology Drive versions before 1.0...
PT-2018-18720 · Synology · Synology Drive
Name of the Vulnerable Software and Affected Versions: Synology Drive versions prior to 1.0.2-10275 Description: The issue is related to improper access control, allowing remote authenticated users to access non-shared files or folders. The exact vectors used for this unauthorized access are not...
CVE-2018-11392
An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4.1.1, as distributed in the Envato Market, allows any remote authenticated user to upload .php files to the web server via a profile avatar field. This results in arbitrary code...
Design/Logic Flaw
An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4.1.1, as distributed in the Envato Market, allows any remote authenticated user to upload .php files to the web server via a profile avatar field. This results in arbitrary code...
CVE-2018-11392
An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4.1.1, as distributed in the Envato Market, allows any remote authenticated user to upload .php files to the web server via a profile avatar field. This results in arbitrary code...
PHP Login And User Management 4.1.0 Shell Upload Vulnerability
Exploit for php platform in category web applications Title PHP Login & User Management = 4.1.0 - Arbitrary File Upload CVE-2018-11392 Product PHP Login & User Management https://codecanyon.net/item/php-login-user-management/49008 CVE CVE-2018-11392 Credit Reginald Dodd Description An arbitrary...
ManageEngine Recovery Manager Plus 5.3 Cross Site Scripting
Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GAREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330 Platform: Java Tested on: Windows CVE: CVE-2018-9163 1. DETAI...
ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting
Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GÜREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330 Platform: Java Tested on: Windows CVE: CVE-2018-9163 1. DETAI...
CVE-2018-9250
interface\super\editlist.php in OpenEMR before v5011 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter...
CVE-2018-9250
The CVE-2018-9250 issue concerns OpenEMR before v5_0_1_1, where the interface\super\edit_list.php file accepts the newlistname parameter and allows remote authenticated users to execute arbitrary SQL commands. The root cause is an SQL injection vulnerability in that endpoint, enabling attackers w...
CVE-2018-10760
CVE-2018-10760 describes an unrestricted file upload vulnerability in ProjectPier's Files plugin (versions 0.88 and earlier). The issue allows remote authenticated users to upload a file with an executable extension and then access it via a direct request to the file in the tmp directory under th...
CVE-2018-0587
Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors...