10771 matches found
CVE-2015-9260
CVE-2015-9260 affects BEdita prior to 3.7.0. A cross-site scripting (XSS) vulnerability is triggered via a crafted pages/showObjects URI, demonstrated by appending a payload to pages/showObjects/2/0/0/leafs. Technical details in connected sources confirm the vulnerability exists in versions befor...
ownCloud: Possible to steal any protected files on Android
Hi. I have found an issue which allows to retrieve any files from /data/data/com.owncloud.android/ directory. The problem is in exported activity com.owncloud.android.ui.activity.ReceiveExternalFilesActivity which accepts a URI to download files. I see that you've added verification path...
CVE-2018-13134
TP-Link Archer C1200 1.13 Build 2018/01/24 rel.52299 EU devices have XSS via the PATHINFO to the /webpages/data URI...
CVE-2018-12910
An out-of-bounds read has been discovered in libsoup when getting cookies from a URI with empty hostname. An attacker may use this flaw to cause a crash in the application...
CVE-2018-13122
onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete Files screen, as demonstrated by a ?i=var/www/html/&f=123.php&p=edit&p=deletefile URI...
CVE-2018-13106
ClipperCMS 1.3.3 has stored XSS via the "Tools - Configuration" screen of the manager/ URI...
CVE-2018-13106
ClipperCMS 1.3.3 is affected by a stored XSS vulnerability in the manager/ Tools → Configuration screen (via the manager/ URI). The issue originates from input that is stored and later rendered unsafely. No remediation or patch details are provided in the connected sources; the CVE entry document...
Cross-Site Scripting (XSS)
opentsdb is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary Javascript through the type parameter with the /suggest URI...
WSTMall Cross-Site Request Forgery Vulnerability
WSTMall is an open source O2O e-commerce system developed using ThinkPHP framework and supporting multiple users. A cross-site request forgery vulnerability exists in WSTMall version 1.9.1170316. A remote attacker can add user accounts with the help of index.php?m=Admin&c=Users&a=edit URI to...
BWS Systems HA-Bridge Device Information Disclosure Vulnerability
BWS Systems HA-Bridge devices are a product for automating the connection and control of IoT devices. A security vulnerability exists in the BWS Systems HA-Bridge devices. A remote attacker could exploit this vulnerability by sending a direct request to the ! /system URI to obtain sensitive...
CVE-2018-13040
OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...
Cross site scripting
OpenSID 18.06-pasca has reflected Cross Site Scripting XSS via the cari parameter, aka an index.php/first?cari= URI...
Cross site request forgery (csrf)
OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...
Cross site request forgery (csrf)
ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/plweb.cgi/utilconfigloginact URI...
CVE-2018-13032
ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/plweb.cgi/utilconfigloginact URI...
CVE-2018-13032
ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/plweb.cgi/utilconfigloginact URI...
CVE-2018-7475
IceWarp Mail Server 12.0.3 is affected by a cross-site scripting (XSS) vulnerability in the webdav/ticket/ URIs. The issue, described in CVE-2018-7475, allows remote attackers to inject arbitrary web script or HTML. Public references confirm XSS in IceWarp Mail Server
CVE-2018-13010
WSTMall v1.9.1170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account...