Cross-site Scripting (XSS)

github.com/gogits/gogs is vulnerable cross-site scripting XSS attacks. The library does not sanitize its user input, allowing a malicious user to inject and execute arbitrary JavaScript...

Arbitrary File Traversal Vulnerability in Ampcom Application Gateway

Ambient Application Gateway is an inter-network device developed by Beijing Ambient Technology Co., Ltd. to interconnect one network with another and provide specific applications. An arbitrary file traversal vulnerability exists in the ABT Application Gateway. An attacker can use user-controllab...

Logrhythm Network Monitor Multiple Vulnerabilities

Logrhythm Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Plugin WA Form Builder SQL Injection

Description: Type user access: any user. $POST ‘waformsId’ is not escaped. WAFormBuilderuioutput is accessible for any user. File / Code: Path: /wp-content/plugins/wa-form-builder/main.php global $wpdb; echo 'SELECT FROM '.$wpdb-prefix.'wapwaformbuilder WHERE Id = '.$REQUEST'waformsId'; $formattr...

WordPress Plugin Nelio AB Testing Server-Side Request Forgery (SSRF)

Case Study: SSRF in Nelio AB Testing WordPress Plugin Nelio AB Testing is a WordPress plugin used for A/B Testing in WordPress pages. We can download the source-code of the Plugin from plugins.svn.wordpress.org/nelio-ab-testing/tags/4.5.8/. Server-side Request Forgery SSRF is a vulnerability wher...

OpenText Documentum Content Server - dm_bp_transition.ebs docbase Method Arbitrary Code Execution

OpenText Documentum Content Server - dmbptransition.ebs docbase Method Arbitrary Code Execution ''' CVE Identifier: CVE-2017-7221 Vendor: OpenText Affected products: OpenText Documentum Content Server all versions Researcher: Andrey B. Panfilov Severity Rating: CVSS v3 Base Score: 8.8...

Weblate: Missing restriction on string size of Full Name at https://demo.weblate.org/accounts/register/

Hi there Vulnerability Title: During my regular testing, I have found that there was no restriction on the amount of text that can be inserted into a user's Full name field. Security Impact: When the text size was large enough the service resulting in a momentary outage in our non-production...

PT-2018-08: SQL injection in Ipswitch WhatsUp Gold

The specialists of the Positive Research center have detected an SQL injection vulnerability in Ipswitch WhatsUp Gold. SQL injection vulnerability in Ipswitch WhatsUp Gold, due to insufficient validation of user input on some .ASP pages, allows attackers to execute arbitrary SQL commands and obta...

Regular Expression Denial Of Service (ReDoS)

uri-js is vulnerable to denial of service DoS attacks. These attacks are possible through the regular expression that validates if a URL is validate. There is a flaw in the regular expression which causes the program to hang and the application to consume 100% of the CPU. This is only possible if...

Remote code execution

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable...

Unrestricted file upload

An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the createReportName and saveReport functions in recoveryconsole/bpl/reports.php allows for an authenticated user to create a randomly named file on disk with a user-controlled extension,...

CVE-2017-7280

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable...

CVE-2017-7280

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable...

MATESO GmbH Password Safe And Repository Enterprise 7.4.4 Build 2247 SQL Injection Vulnerability

Exploit for multiple platform in category web applications Products: Password Safe and Repository Enterprise Manufacturer: MATESO GmbH Affected Versions: 7.4.4 Build 2247 Tested Versions: 7.4.4 Build 2247 Vulnerability Type: Violation of Secure Design Principles CWE-657 SQL Injection CWE-89 Risk...

Windows Hyper-V Information Disclosure Vulnerability

An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker on a guest operating system could run a specially crafted application...

Rocket.Chat: XSS via /api/v1/chat.postMessage

The victim could craft a custom message using the REST API that, once seen by the observer, executed arbitrary code in the context of the client user. The vulnerability was present in the attachment fields, where the first field's value could be used to inject HTML tags...

CVE-2017-2674

JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote, authenticated attackers that have privileges to create lists can store scripts in them, which are not properly...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due t...

CVE-2017-7233

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects namely django.utils.http.issafeurl considered some numeric URLs "safe" when they shouldn't be, aka an open...

Open redirect

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects namely django.utils.http.issafeurl considered some numeric URLs "safe" when they shouldn't be, aka an open...