CVE-2019-17524

An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the "Connected Clients" field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this...

Hardcoded credentials

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka the adm/boardformupdate.php bocontenttail parameter...

PT-2019-9620 · Gnuboard · Gnuboard5

Name of the Vulnerable Software and Affected Versions: GNUBOARD5 version 5.3.1.9 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the bo content tail parameter, also referred to as the "board tail contents" parameter, in the "adm/board form update.php" API...

CVE-2011-4631

TYPO3 XSS (CVE-2011-4631) affects TYPO3 core prior to 4.3.12, 4.4.x prior to 4.4.9, and 4.5.x prior to 4.5.4. The vulnerability allows remote attackers to inject arbitrary web script/HTML via the system extension recycler. Impact: potential client-side code execution under user context. Remediati...

CVE-2019-16701

pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.execphp call containing shell metacharacters in a parameter value...

CVE-2019-16701

pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.execphp call containing shell metacharacters in a parameter value...

Code injection

pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.execphp call containing shell metacharacters in a parameter value...

CVE-2019-16701

pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.execphp call containing shell metacharacters in a parameter value...

CVE-2019-16701

CVE-2019-16701 affects pfSense 2.3.4 through 2.4.4-p3. The issue is a Remote Code Injection via a methodCall XMLRPC payload containing shell metacharacters in a pfsense.exec_php parameter, allowing an authenticated user to execute OS commands. Red Hat, NVD, OSV, CNVD and related feeds corroborate...

Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection Exploit #RCE

Exploit for php platform in category web applications Exploit Title: Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection Author: Nassim Asrir Vendor Homepage: https://www.pfsense.org/ Contact: email protected | https://www.linkedin.com/in/nassim-asrir-b73a57122/ CVE: CVE-2019-16701 Tested On: Window...

pfSense 2.3.4 / 2.4.4-p3 Remote Code Injection

Exploit Title: Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection Date: 23/09/2018 Author: Nassim Asrir Vendor Homepage: https://www.pfsense.org/ Contact: [email protected] | https://www.linkedin.com/in/nassim-asrir-b73a57122/ CVE: CVE-2019-16701 Tested On: Windows 1064bit | Pfsense 2.3.4 / 2.4.4-...

Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection

Exploit Title: Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection Date: 23/09/2018 Author: Nassim Asrir Vendor Homepage: https://www.pfsense.org/ Contact: [email protected] | https://www.linkedin.com/in/nassim-asrir-b73a57122/ CVE: CVE-2019-16701 Tested On: Windows 1064bit | Pfsense 2.3.4 / 2.4.4-...

CVE-2019-1896

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to inject arbitrary commands and obtain root privileges. The vulnerability is due to insufficient validation of user-supplied input in the Certificate...

CVE-2018-18670

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Extra Contents" parameter, aka the adm/configformupdate.php cf110 parameter...

CVE-2018-18673

GNUBOARD5 5.3.1.9 contains a Cross‑Site Scripting (XSS) flaw in the adm/menu_list_update.php me_link parameter (Menu Link). This allows remote attackers to inject arbitrary web script/HTML. Public details consistently reference the same vulnerability across multiple feeds; no exploit specifics ar...

CVE-2019-9230

An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting XSS vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script o...

CVE-2019-11827

Cross-site scripting XSS vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to inject arbitrary web script or HTML via the objectid parameter...

CVE-2019-11827

Cross-site scripting XSS vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to inject arbitrary web script or HTML via the objectid parameter...

CVE-2019-11828

Synology Office’s Chart component is affected by a Cross‑Site Scripting (XSS) vulnerability in versions prior to 3.1.4-2771. The issue arises from insufficient client data validation, enabling remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Impact is web...

MantisBT Cross-Site Scripting Vulnerability (CNVD-2019-19293)

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in the View Filters and Edit Filter pages in MantisBT versions 2.1.0...