ScreenOS: Stored Cross-Site Scripting (XSS) vulnerability

A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2018-17442

An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerability in the onUploadLogPic endpoint allows remote authenticated users to execute arbitrary PHP code...

CVE-2018-17442

An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerability in the onUploadLogPic endpoint allows remote authenticated users to execute arbitrary PHP code...

CVE-2018-1250

Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains an Authorization Bypass vulnerability. A remote authenticated user could potentially exploit this vulnerability to read files in NAS server by directly interacting with certain APIs of Unity OE, bypassing Role-Based...

CVE-2018-1250

The CVE-2018-1250 entry concerns Dell EMC Unity and UnityVSA prior to 4.3.1.1525703027, where an Authorization Bypass vulnerability allows a remotely authenticated user to read files on the NAS server by directly interacting with Unity OE APIs, bypassing role-based checks that apply only in the U...

MediaWiki Restriction Bypass Vulnerability

MediaWiki is a free software open source wiki package written in PHP, originally used for Wikipedia, but now also used by several other projects of the non-profit Wikimedia Foundation and many other wikis. MediaWiki suffers from a limitation bypass vulnerability that stems from the '$wgRateLimits...

Code injection

BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php...

CVE-2018-17030

BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php...

CVE-2018-17030

BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php...

CVE-2018-17030

CVE-2018-17030 affects BigTree CMS 4.2.23. The vulnerability allows remote authenticated users who have privileges to set hooks to execute arbitrary code via /core/admin/auto-modules/forms/process.php. Public references in the connected documents consistently describe an arbitrary code execution ...

CVE-2018-1571

IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 143121...

CVE-2018-0655

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

UBUNTU-CVE-2018-16358

A cross-site scripting XSS vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml...

Cross site scripting

A stored Cross-site scripting XSS vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field...

CVE-2018-16316

A stored Cross-site scripting XSS vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field...

CVE-2018-16316

A stored Cross-site scripting XSS vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field...

Authorization

phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter...

Sql injection

SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function...

CVE-2014-6049

phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter...

CVE-2014-6047

CVE-2014-6047 affects phpMyFAQ prior to 2.8.13. The vulnerability exists in the download attachments path (phpmyfaq/attachment.php) due to incorrect permission checks, enabling remote authenticated users with some rights (e.g., add/delete attachments) to read arbitrary attachments they should not...