CVE-2018-7197

An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting XSS vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL...

CVE-2018-7197

An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting XSS vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL...

CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

CVE-2016-4923

Insufficient cross site scripting protection in J-Web component in Juniper Networks Junos OS may potentially allow a remote unauthenticated user to inject web script or HTML and steal sensitive data and credentials from a J-Web session and to perform administrative actions on the Junos device...

CVE-2017-14083

A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to download the OfficeScan encryption file...

CVE-2017-14089

An Unauthorized Memory Corruption vulnerability in Trend Micro OfficeScan 11.0 and XG may allow remote unauthenticated users who can access the OfficeScan server to target cgiShowClientAdm.exe and cause memory corruption issues...

CVE-2017-12930

SQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version 1.5.10 allows remote unauthenticated users to access the web interface as administrator via a crafted password...

CVE-2017-12930

SQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version 1.5.10 allows remote unauthenticated users to access the web interface as administrator via a crafted password...

CVE-2017-4052

Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense ATD 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to change or update any configuration settings, or gain administrator functionality via a crafted HTTP request parameter...

Information disclosure

Information disclosure vulnerability in McAfee now Intel Security Cloud Analysis and Deconstructive Services CADS 1.0.0.3x, 1.0.0.4d and earlier allows remote unauthenticated users to view, add, and remove users via a configuration error...

CVE-2014-9921

Information disclosure vulnerability in McAfee now Intel Security Cloud Analysis and Deconstructive Services CADS 1.0.0.3x, 1.0.0.4d and earlier allows remote unauthenticated users to view, add, and remove users via a configuration error...

CVE-2014-9921

Information disclosure vulnerability in McAfee now Intel Security Cloud Analysis and Deconstructive Services CADS 1.0.0.3x, 1.0.0.4d and earlier allows remote unauthenticated users to view, add, and remove users via a configuration error...

CVE-2015-4591

eClinicalWorks Population Health CCMR suffers from a cross site scripting vulnerability in login.jsp which allows remote unauthenticated users to inject arbitrary javascript via the strMessage parameter...

SerVision HVG Default Credentials (HTTP)

SerVision HVG is using known default credentials. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PhpWiki 1.5.4 - Multiple Vulnerabilities

Title: phpwiki 1.5.4 - Cross Site Scripting / Local File Inclusion Date: 29.08.15 Vendor: sourceforge.net/projects/phpwiki/ Affected versions: = 1.5.4 current Tested on: Apache2.2 / PHP5 / Deb32 Author: Smash Contact: smash at devilteam.pl 1/ Cross Site Scripting Cross-site scripting vulnerabilit...

Updated wordpress packages fix security vulnerabilities

Updated wordpress packages fixes security vulnerabilities: The wordpress package has been updated to version 3.9.4, which fixes several security issues, including a cross-site scripting issue which can be exploited by remote unauthenticated users...

PT-2016-01: Arbitrary File Upload in Advantech WebAccess

The specialists of the Positive Research center have detected an Arbitrary File Upload vulnerability in Advantech WebAccess. It was discovered that Advantech WebAccess before 8.1 allows remote unauthenticated users to create or write to arbitrary files on the server. How to fix Update your softwa...

MediaWiki Thumb.php Remote Command Execution Exploit

Exploit for multiple platform in category remote exploits require 'msf/core' class Metasploit3 'MediaWiki Thumb.php Remote Command Execution', 'Description' = %q MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows...

Samsung DVR authentication bypass

Title: Samsung DVR authentication bypass Version affected: firmware version = 1.10 Vendor: Samsung - www.samsung-security.com Discovered by: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it Twitter: @andreaf83 Status: unpatched Samsung provides a wide range of DVR...

Bitweaver 2.8.1 Multiple Vulnerabilities

Finding 1: Local File Inclusion Vulnerability CVE: CVE-2012-5192 Finding 2: Multiple XSS Vulnerabilities in Bitweaver CVE: CVE-2012-5193 Trustwave SpiderLabs Security Advisory TWSL2012-016: Multiple Vulnerabilities in Bitweaver Published: 10/23/2012 Version: 1.0 Vendor: Bitweaver...