Deserialization of untrusted data

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP fileexists function is used with user-controlled entries, and phar:// URLs trigger deserialization...

CVE-2019-12868: Deserialization of Untrusted Data

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP fileexists function is used with user-controlled entries, and phar:// URLs trigger deserialization...

CVE-2019-12868

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP fileexists function is used with user-controlled entries, and phar:// URLs trigger deserialization...

CVE-2018-19892

DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field...

CVE-2018-19892

DomainMOD 4.11.01 has a Cross-Site Scripting (XSS) vulnerability via the admin/dw/add-server.php DisplayName, HostName, or UserName fields. The Nuclei template specifies the path as /domain//admin/dw/add-server.php and describes a stored XSS that can execute arbitrary JavaScript in the victim’s b...

PT-2018-15144

Name of the Vulnerable Software and Affected Versions DomainMOD versions prior to 4.11.02 Description The issue allows for XSS attacks via the DisplayName, HostName, or UserName field in the admin/dw/add-server.php page. Recommendations For DomainMOD versions prior to 4.11.02, update to version...

CVE-2018-19892: Improper Neutralization of Input During Web Page Generation

DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field...

CVE-2018-6382

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...

Sql injection

DISPUTED MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statemen...

CVE-2018-6382

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...

CVE-2018-6382

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...

PT-2018-17520 · Mantisbt · Mantisbt

Name of the Vulnerable Software and Affected Versions: MantisBT version 2.10.0 Description: The issue allows local users to conduct SQL Injection attacks via the sql parameter in a request to the server.php endpoint, accessible from the 127.0.0.1 IP address. It is worth noting that the vendor...

CVE-2018-6382: Improper Neutralization of Special Elements used in an SQL Command

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...

hitek.fr XSS vulnerability

Vulnerable URL: http://hitek.fr/server.php?action=loadproducts Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 19:03 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 11727 VIP website status:| Yes Check hitek.f...

handyhost.ru XSS vulnerability

Vulnerable URL: https://handyhost.ru/livezilla/server.php/bizaaooyds?request=track=jcrpt=0.11014420824661403 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 483971 VIP website...

CVE-2015-7698

icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the 1 listShares function in Server.php or the 2 connect or 3 read function in Share.php...

Command injection

icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the 1 listShares function in Server.php or the 2 connect or 3 read function in Share.php...

CVE-2015-7698

CVE-2015-7698 affects ownCloud Server’s external legacy SMB storage. The issue arises from inadequate neutralization of special characters in SMB user input, enabling remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument (affecting listShares i...

PT-2015-2445

Name of the Vulnerable Software and Affected Versions icewind1991 SMB versions prior to 1.0.3 Description The issue exists due to the lack of neutralization of special elements used in operating system commands. This allows a remote attacker to execute arbitrary SMB commands using special...

CVE-2015-7698: Improper Neutralization of Special Elements used in an OS Command

icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the 1 listShares function in Server.php or the 2 connect or 3 read function in Share.php...