3816 matches found
CVE-2018-20486
MetInfo 6.x through 6.1.3 has XSS via the /admin/login/logincheck.php urlarray parameter...
CVE-2018-20171
An issue was discovered in Nagios XI before 5.5.8. The url parameter of rssdashlet/magpierss/scripts/magpiesimple.php is not filtered, resulting in an XSS vulnerability...
CVE-2018-20172
An issue was discovered in Nagios XI before 5.5.8. The rssurl parameter of rssdashlet/magpierss/scripts/magpieslashbox.php is not filtered, resulting in an XSS vulnerability...
CVE-2018-20171
Summary of CVE-2018-20171 (Nagios XI): Nagios XI builds prior to 5.5.8 are affected by an XSS vulnerability in the url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php where the parameter is not filtered. This can allow a user-assisted or external attacker to inject script in contexts...
CVE-2018-20171: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Nagios XI before 5.5.8. The url parameter of rssdashlet/magpierss/scripts/magpiesimple.php is not filtered, resulting in an XSS vulnerability...
PT-2018-15284
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.5.8 Description An issue was discovered where the url parameter of the "rss dashlet/magpierss/scripts/magpie simple.php" endpoint is not filtered, resulting in a potential XSS issue. Recommendations For versions...
CVE-2018-19922
Persistent Cross-Site Scripting XSS in the advancedsetupwebsiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTML into the Website Blocking page by inserting arbitrary HTML into the 'TodUrlAdd...
Directory traversal
Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar issue to CVE-2018-11344...
Directory traversal
Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter. NOTE: the "filename" POST parameter is covered by CVE-2018-11345...
Command injection
OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secretkey" URL parameter...
CVE-2018-12306
Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar issue to CVE-2018-11344...
CVE-2018-12308
Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encryptkey" URL parameter...
CVE-2018-14700
Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL log files via the "name" URL parameter...
CVE-2018-14699
System command injection in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...
Ninja Forms <= 3.3.19 - Authenticated Open Redirect
Open Redirect vulnerability in download submission page using URL parameter...
Seopanel 3.13.0 Cross Site Scripting
Multiple Reflected Cross-site Scripting Vulnerabilities in Seopanel 3.13.0 Information -------------------- Advisory by Netsparker Name: Reflected Cross-site Scripting Vulnerabilities in Seopanel Affected Software: Seopanel Affected Versions: 3.13.0 Homepage: https://www.seopanel.in Vulnerability...
CVE-2018-13360
Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter...
Cross site scripting
Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter...