18943 matches found
CVE-2014-8540
The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks...
Design/Logic Flaw
Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...
CVE-2017-17867
Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...
CVE-2017-17867
CVE-2017-17867 concerns Inteno IOPSYS devices (2.0–3.14 and 4.0) where remote authenticated users can execute arbitrary OS commands by manipulating the leasetrigger field in the odhcpd config via an SMB share, due to insufficient protection of OpenWrt config (not using /etc/uci-defaults). Connect...
Webmin XSS Vulnerability - Linux
Webmin is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webmin:webmin"; if...
Webmin XSS Vulnerability - Windows
Webmin is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webmin:webmin"; if...
CVE-2017-17089
custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality...
CVE-2017-15886
Server-side request forgery SSRF vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via 1 COMMAND, 2 COMMANDS INSTRUCTION, or 3 DESCRIPTION parameter...
CVE-2017-15892
Multiple cross-site scripting XSS vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via 1 COMMAND, 2 COMMANDS INSTRUCTION, or 3 DESCRIPTION parameter...
CVE-2017-15886
Server-side request forgery SSRF vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI...
CVE-2017-15892
Multiple cross-site scripting XSS vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via 1 COMMAND, 2 COMMANDS INSTRUCTION, or 3 DESCRIPTION parameter...
Synology MailPlus Server Cross-Site Scripting Vulnerability
Synology MailPlus Server is a mail server solution for businesses. A cross-site scripting vulnerability exists in the User Policy editor in Synology MailPlus Server. A remote authenticated user can exploit the vulnerability to inject arbitrary HTML via the name parameter...
CVE-2017-16768
Cross-site scripting XSS vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary HTML via the name parameter...
CVE-2017-17888
cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...
CVE-2017-17888
cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...
CVE-2017-17888
cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...
Input validation
Huawei SmartCare V200R003C10 has a CSV injection vulnerability. An remote authenticated attacker could inject malicious CSV expression to the affected device...
CVE-2017-15312
Huawei SmartCare V200R003C10 is affected by a stored XSS vulnerability in the dashboard module. A remote authenticated attacker could inject malicious scripts into the affected device via the dashboard, enabling script execution in the user’s browser. The issue is documented across multiple recor...