The vulnerability of the Wizard component in the microprogramming software of the RICOH MP multifunctional device allows a hacker to inject any code into the protected web page.

The vulnerability of the Wizard component file /web/entry/en/address/adrsSetUserWizard.cgi of the RICOH MP multifunctional device exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into...

The vulnerability of the Wizard component in the microprogramming software of the RICOH MP multifunctional device allows a hacker to inject any code into the protected web page.

The vulnerability of the Wizard component file /web/entry/en/address/adrsSetUserWizard.cgi of the RICOH MP multifunctional device exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into...

The vulnerability of the Wizard component in the microprogramming software of the RICOH MP multifunctional device allows a hacker to inject any code into the protected web page.

The vulnerability of the Wizard component file /web/entry/en/address/adrsSetUserWizard.cgi of the RICOH MP multifunctional device exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into...

The vulnerability of the Wizard component in the microprogramming software of the RICOH MP multifunctional device allows a hacker to inject any code into the protected web page.

The vulnerability of the Wizard component file /web/entry/en/address/adrsSetUserWizard.cgi of the RICOH MP multifunctional device exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into...

Code injection

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports ...

PT-2018-3085 · Rockwell Automation · Rockwell Automation Allen-Bradley Powermonitor 1000

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions Description: The issue is related to insufficient input validation, which could allow a remote attacker to inject arbitrary code into a targeted user's web browser, potentially...

The vulnerability of the “Replacement Messages” component of the FortiOS operating system’s web interface, allowing a hacker to inject arbitrary JavaScript or HTML code

The vulnerability of the Replacement Messages component in the FortiOS operating system’s web interface arises due to insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript or HTML code remotely...

Catfish CMS Cross-Site Scripting Vulnerability (CNVD-2019-01927)

Catfish CMS is an open source content management system CMS written in PHP. A cross-site scripting vulnerability exists in Catfish CMS version 4.8.30, which can be exploited by remote attackers to inject code...

catfish blog cross-site scripting vulnerability

Catfish blog is a set of open source blog system developed using the PHP language . A cross-site scripting vulnerability exists in Catfish blog version 2.0.33. A remote attacker can exploit this vulnerability to inject code...

Spring Data Commons remote code injection vulnerability

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

Palo Alto Networks PAN-OS Cross-Site Scripting Vulnerability (CNVD-2018-21185)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A cross-site scripting vulnerability in the GlobalProtect Portal Login page in versions of Palo Alto Networks PAN-OS prior to 8.1.4 can be exploited by remote attackers to inject...

EulerOS 2.0 SP2 : mutt (EulerOS-SA-2018-1304)

According to the versions of the mutt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - mutt: Remote code injection vulnerability to an IMAP mailbox CVE-2018-14354 - mutt: Remote Code Execution via backquote characters CVE-2018-14357 -...

EulerOS 2.0 SP3 : mutt (EulerOS-SA-2018-1305)

According to the versions of the mutt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - mutt: Remote code injection vulnerability to an IMAP mailbox CVE-2018-14354 - mutt: Remote Code Execution via backquote characters CVE-2018-14357 -...

IBM Rational Engineering Lifecycle Manager Cross-Site Scripting Vulnerability (CNVD-2018-20088)

IBM Rational Engineering Lifecycle Manager is a suite of engineering lifecycle management software from IBM in the United States. A cross-site scripting vulnerability exists in IBM Rational Engineering Lifecycle Manager versions 5.0 through 5.02 and 6.0 through 6.0.6. A remote attacker can exploi...

Subsonic cross-site scripting vulnerability (CNVD-2018-20096)

Subsonic is a media file hosting platform developed and maintained by software developer Sindre Mehus. A cross-site scripting vulnerability exists in the settings of the translation code in Subsonic version 6.1.1. A remote attacker can exploit the vulnerability by sending multiple parameters to t...

CuppaCMS Cross-Site Scripting Vulnerability

CuppaCMS is a content management system CMS. A cross-site scripting vulnerability exists in CuppaCMS 2018-09-03 and prior versions. A remote attacker can exploit the vulnerability by sending the 'section' parameter to the administrator//component/tablemanager/view/cumenus URL to inject malicious...

CVE-2018-17183

Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code...

UBUNTU-CVE-2018-17183

Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code...

GHSA-QC8J-M8J3-RJQ6 Moderate severity vulnerability that affects rails-html-sanitizer

Withdrawn, accidental duplicate publish. Cross-site scripting XSS vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes...

Design/Logic Flaw

In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator...