dotCMS Open Redirect Vulnerability

dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A security vulnerability exists in dotCMS versions prior to 5.0.2. An attacker can exploit this vulnerability to...

CVE-2019-9592

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2019-9592

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2019-9592: Improper Neutralization of Input During Web Page Generation

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

MeteoTemplate 17.1 Nectarine windDirection 2.2 Open Redirection

Exploit Title : MeteoTemplate 17.1 Nectarine windDirection Plugins 2.2 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 26/02/2019 Vendor Homepage : meteotemplate.com Software Download Link :...

CVE-2019-8432

In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter...

CVE-2019-8432

In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter...

PT-2019-19032

Name of the Vulnerable Software and Affected Versions CmsEasy version 7.0 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs via the url parameter in the ckplayer.php API endpoint. Recommendations For CmsEasy version 7.0, consider restricting access to the...

CVE-2019-8432: Improper Neutralization of Input During Web Page Generation

In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter...

CVE-2019-8432

CmsEasy 7.0 is affected by a cross-site scripting (XSS) vulnerability in the ckplayer.php URL parameter. The issue is documented across multiple sources (NVD, Red Hat, CVE lists) as an XSS in CmsEasy 7.0 via ckplayer.php, but no further technical specifics (such as exact code path, exploit detail...

CVE-2018-15657

An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter...

PT-2019-9153

Name of the Vulnerable Software and Affected Versions 42Gears SureMDM versions prior to 2018-11-27 Description A Server-Side Request Forgery SSRF issue was found, allowing exploitation via the /api/DownloadUrlResponse.ashx API endpoint, specifically through the url parameter. Recommendations For...

CVE-2018-15657: Server-Side Request Forgery (SSRF)

An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter...

PT-2019-16767 · Labkey · Labkey Server Community Edition

Name of the Vulnerable Software and Affected Versions: LabKey Server Community Edition versions prior to 18.3.0-61806.763 Description: The issue is related to an open redirect vulnerability. It affects the / r1/ API endpoint, specifically the returnURL parameter, allowing an unauthenticated remot...

NEC Aterm W300P Buffer Overflow Vulnerability

The NEC Aterm W300P is a wireless router from Nippon Electric NEC. A buffer overflow vulnerability exists in the NEC Aterm W300P using firmware version 1.0.13 and earlier, which can be exploited by an attacker to execute arbitrary code with the help of the 'submit-url' parameter...

Design/Logic Flaw

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode parameter of a certain URL...

Buffer overflow

Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter...

CVE-2018-0633: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter...

CVE-2018-18004

Incorrect Access Control in modinetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable arbitrary system services via a URL parameter...

SugarCRM (ConnectorsController) Server-Side Request Forgery Vulnerability

SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A server-side...