18934 matches found
CVE-2019-19990
An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Multiple Stored Cross-site scripting XSS vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /monitor/sheadmodel.php and /vam/vamuser.php...
CVE-2019-19991
An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Multiple Reflected Cross-site scripting XSS vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /vam/vamanagraphic.php, /vam/vamvamuser.php, /common/vampmain.php...
CVE-2019-19991
CVE-2019-19991 concerns Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29, where multiple reflected XSS flaws are exploitable by remote authenticated users. The vulnerabilities affect specific web pages: /vam/vam_anagraphic.php, /vam/vam_vamuser.php, /common/vamp_main.php, and /wiz...
CVE-2020-6842
D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the media renderer name...
Design/Logic Flaw
D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the media renderer name...
CVE-2020-6842
D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the media renderer name...
Default credentials
D-Link DSR-250N devices before 1.08B31 allow remote authenticated users to obtain "persistent root access" via the BusyBox CLI, as demonstrated by overwriting the super user password...
PT-2020-7317 · D Link · Dsr-250N
Name of the Vulnerable Software and Affected Versions: D-Link DSR-250N versions prior to 1.08B31 Description: The issue allows remote authenticated users to obtain persistent root access via the BusyBox CLI, as demonstrated by overwriting the super user password. Recommendations: For versions pri...
CVE-2015-0258
Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a 1 .php3, 2 .php4, 3 .php5, or 4 .phtml extension...
CVE-2015-0258
Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a 1 .php3, 2 .php4, 3 .php5, or 4 .phtml extension...
CVE-2013-4225
The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...
CVE-2013-4225
The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...
CVE-2014-3826
Cross-site scripting XSS vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profilefields module...
CVE-2014-3827
Multiple cross-site scripting XSS vulnerabilities in the MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the 1 edit or 2 add action in the user-users module or the 3 finduser action or the name parameter in a...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the 1 edit or 2 add action in the user-users module or the 3 finduser action or the name parameter in a...
Cross site scripting
Cross-site scripting XSS vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profilefields module...
CVE-2014-3826
Cross-site scripting XSS vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profilefields module...
CVE-2014-3826
CVE-2014-3826 affects MyBB prior to 1.6.13. It is a Cross-site Scripting (XSS) vulnerability exploitable by remote authenticated users via the name parameter in the edit action of the config-profile_fields module. The issue enables injection of arbitrary web script or HTML and is documented acros...
CVE-2014-3827
Multiple cross-site scripting XSS vulnerabilities in the MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the 1 edit or 2 add action in the user-users module or the 3 finduser action or the name parameter in a...
