ArangoDB Community Edition 3.4.2-1 Cross Site Scripting

Exploit Title: ArangoDB Community Edition 3.4.2-1 | Cross-Site Scripting Date: 17.02.2019 Exploit Author: Ozer Goker Vendor Homepage: https://www.arangodb.com Software Link: https://www.arangodb.com/download-major/ Version: 3.4.2-1 Introduction ArangoDB is a native multi-model, open-source databa...

ArangoDB Community Edition 3.4.2-1 - Cross-Site Scripting

ArangoDB Community Edition 3.4.2-1 - Cross-Site Scripting Exploit Title: ArangoDB Community Edition 3.4.2-1 | Cross-Site Scripting Date: 17.02.2019 Exploit Author: Ozer Goker Vendor Homepage: https://www.arangodb.com Software Link: https://www.arangodb.com/download-major/ Version: 3.4.2-1...

CVE-2019-5595: Incomplete Cleanup

In FreeBSD before 11.2-STABLEr343782, 11.2-RELEASE-p9, 12.0-STABLEr343781, and 12.0-RELEASE-p3, kernel callee-save registers are not properly sanitized before return from system calls, potentially allowing some kernel data used in the system call to be exposed...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

PT-2019-18723

Name of the Vulnerable Software and Affected Versions nc-cms version 3.5 Description The issue allows for the upload of .php files. This is achieved through the index.php?action=save endpoint, utilizing the name and editordata parameters. Recommendations For nc-cms version 3.5, restrict access to...

The vulnerability of the programmatically defined Cisco SD-WAN network, which arises due to insufficient validation of input data, allows a hacker to modify arbitrary files and increase their privileges.

The vulnerability of the programmatically defined Cisco SD-WAN network exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to modify arbitrary files and elevate their privileges to root by changing the “save” command in the command interface...

PT-2019-17768

Name of the Vulnerable Software and Affected Versions FreeBSD versions prior to 11.2-STABLEr343782 FreeBSD versions prior to 11.2-RELEASE-p9 FreeBSD versions prior to 12.0-STABLEr343781 FreeBSD versions prior to 12.0-RELEASE-p3 Description The issue is related to the improper sanitization of kern...

CVE-2019-1000003

MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery CSRF vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvgsave that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be...

PT-2019-11257

Name of the Vulnerable Software and Affected Versions: MapSVG Lite versions prior to 3.3.0 Description: The issue allows an attacker to modify post data, including embedding javascript, due to a Cross Site Request Forgery CSRF vulnerability in the REST endpoint...

PT-2019-18475

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.13 Description An issue was discovered that allows directory traversal via the app parameter, set to /../, in the "admincp.php?app=apps&do=save" endpoint. This can lead to the creation of a ZIP archive file containi...

Cisco SD-WAN Solution Input Validation Error Vulnerability

Cisco vBond Orchestrator Software and other products are from Cisco. cisco vBond Orchestrator Software is a set of security network extension management software. vEdge 100 Series Routers is a 100 series router product. SD-WAN Solution is a set of network extension solution running in it. An inpu...

CVE-2019-6779

Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links...

CVE-2019-1650

A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation of the save command in the CLI of the affected software. An...

PT-2019-18338

Name of the Vulnerable Software and Affected Versions Cscms version 4.1.8 Description The issue allows for a CSRF attack on the "admin.php/links/save" endpoint to add, modify, or delete friend links. Recommendations For version 4.1.8, update to a newer version that includes a fix for this issue, ...

CVE-2019-6779: Cross-Site Request Forgery (CSRF)

Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links...

CVE-2019-1650: Improper Input Validation

A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation of the save command in the CLI of the affected software. An...

PT-2019-1296

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN Solution affected versions not specified Description The issue is due to improper input validation of the save command in the CLI of the affected software. An attacker could exploit this by modifying the save command in the CLI to...

The vulnerability of the pnp-save.sh service on the TeNIX programmable logic controllers MFC1500 and MFC3000 allows a hacker to read data stored by other users on the device.

The vulnerability of the pnp-save.sh service in the TeNIX operating system for programmable logic controllers MFC1500 and MFC3000 is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to remotely read data stored by other users on the devic...

Updated spice-vdagent package fixes security vulnerability

Improperly escaped save directory that is passed to the shell allows local attacker with access to the session the agent runs to inject arbitrary commands to be executed CVE-2017-15108...