Cross site scripting

Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...

CVE-2017-5866

The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2017-5832

Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...

CVE-2017-5867

ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service server hang and logfile flooding via a one bit BMP file...

CVE-2016-5374

NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted data to bypass intended sharing restrictions by leveraging improper handling of the ownerrights ACL entry...

CVE-2016-5374

NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted data to bypass intended sharing restrictions by leveraging improper handling of the ownerrights ACL entry...

CVE-2016-9259

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9261

Cross-site scripting XSS vulnerability in Tenable Log Correlation Engine aka LCE before 4.8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Tenable Log Correlation Engine aka LCE before 4.8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9261

Cross-site scripting XSS vulnerability in Tenable Log Correlation Engine aka LCE before 4.8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

F5 Networks BIG-IP : Apache Tomcat 6.x vulnerability (K30971148)

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web...

CVE-2017-2635

A NULL pointer deference flaw was found in the way libvirt handled empty drives. A remote authenticated attacker could use this flaw to crash libvirtd daemon resulting in denial of service...

CVE-2016-4043

Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...

CVE-2016-4043

Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...

CVE-2017-5585

OpenText Documentum Content Server formerly EMC Documentum Content Server 7.3, when PostgreSQL Database is used and returntopresultsrowbased config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary...

CVE-2017-5585

OpenText Documentum Content Server formerly EMC Documentum Content Server 7.3, when PostgreSQL Database is used and returntopresultsrowbased config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary...

Design/Logic Flaw

OpenText Documentum Content Server formerly EMC Documentum Content Server 7.3, when PostgreSQL Database is used and returntopresultsrowbased config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary...

CVE-2017-6077

ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the pingIPAddr field of an HTTP POST request. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attack...

PT-2017-3168 · NetGear · Netgear Dgn2200

Name of the Vulnerable Software and Affected Versions: NETGEAR DGN2200 versions through 10.0.0.50 Description: The issue allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping IPAddr field of an HTTP POST request to the ping.cgi endpoint. This is d...