3988 matches found
Design/Logic Flaw
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page...
CVE-2018-18553
Leanote 2.6.1 is affected by a cross-site scripting (XSS) vulnerability in the Blog Basic Setting title field, exploitable via rendering of the Likes page. The issue stems from mishandling the title field during page rendering, allowing injected scripts/HTML to execute in affected contexts. Pub...
cn.hutool:hutool-aop (>=4.0.0 <=4.1.11), cn.hutool:hutool-bloomFilter (>=4.0.0 <=4.1.11) +79 more potentially affected by CVE-2018-17297 via cn.hutool:hutool-core (>=4.0.0 <=4.1.11)
cn.hutool:hutool-core MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.11 and more Source cves: CVE-2018-17297 Source advisory: OSV:GHSA-RHQ2-2574-78MC...
CVE-2018-18430
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
CVE-2018-18430
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
Design/Logic Flaw
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
CVE-2018-18430
DESTOON B2B 7.0 contains an XSS vulnerability in admin/setting.inc.php reachable via the first text box to the admin.php URI. The issue is publicly documented across multiple sources (NVD entry CVE-2018-18430; CNVD/CVELIST entries) and is reflected with a CVSS profile indicating a MEDIUM base sev...
DiliCMS Cross-Site Scripting Vulnerability (CNVD-2019-17480)
DiliCMS is a rapid development content management system based on CodeIgniter. DiliCMS has a cross-site scripting vulnerability that can be exploited to inject web scripts and obtain sensitive information via the attachmenturl parameter of admin/index.php/setting/site?tab=siteattachment...
CVE-2018-18210
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
Cross site scripting
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
Microsoft Office: Disable Opt-in Wizard on first run
This test checks the setting for policy OpenVAS Vulnerability Test $Id: officeoptinwizard.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Disable Opt-in Wizard on first run Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is...
CVE-2018-15379 Cisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability
A vulnerability in which the HTTP web server for Cisco Prime Infrastructure PI has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file. This file could allow the attacker to execute commands at the privilege level of the user prime. This...
CVE-2018-15379 Cisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability
A vulnerability in which the HTTP web server for Cisco Prime Infrastructure PI has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file. This file could allow the attacker to execute commands at the privilege level of the user prime. This...
CVE-2018-1672
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user. IBM X-Force ID: 144958...
PT-2018-3640 · Wikimedia +1 · Mediawiki +1
Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.1 Description: The issue is related to a lack of input validation mechanism in MediaWiki, which can be exploited by a remote attacker to impact data integrity. Specifically, when MediaWiki:Mainpage is set to...
RHEL 7 : firefox (RHSA-2018:2835)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2835 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...
Cross site scripting
On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...
RICOH MP 305+ Printer - Cross-Site Scripting
RICOH MP 305+ Printer - Cross-Site Scripting Exploit Title: RICOH MP 305+ Printer - Cross-Site Scripting Date: 2018-09-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link:...
Microsoft Windows Defender AV: Turn on behavior monitoring
This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavbehaviormonitoring.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Turn on behavior monitoring Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is...
Microsoft Windows Defender AV: Threat alert levels at which default action should not be taken (High)
This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavthreatseveritydefaultaction4.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Specify threat alert levels at which default action should not be taken when detected High Authors: Emanuel Moss Copyright: Copyright c...