59 matches found
CVE-2020-15612
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxftpmanager.php. When parsing the userLogin parameter, the process...
PT-2020-14535 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax ftp...
CVE-2017-0363
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites...
UBUNTU-CVE-2017-0363
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites...
CVE-2017-0363
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites...
CVE-2017-0363
MediaWiki prior to 1.28.1, 1.27.2, and 1.23.16 contains a redirect flaw where Special:UserLogin?returnto=interwiki:foo can lead users to external sites. The vulnerability affects the web interface’s login/redirect flow and could expose users to external redirects. Connected sources (including ven...
tc.planestate.co.th XSS vulnerability
Vulnerable URL: http://tc.planestate.co.th/TC/th/userlogin.asp?error="Please login=true Details: Description| Value ---|--- Patched:| No Latest check for patch:| 20.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:|...
pilotundflugzeug.de XSS vulnerability
Vulnerable URL: https://www.pilotundflugzeug.de/servlet/protect/UserLogin.class?showSendPassword Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 264556 VIP website status:| No...
Sonicwall 8.1.0.2-14sv - sitecustomization.cgi Command Injection (Metasploit)
Sonicwall 8.1.0.2-14sv - sitecustomization.cgi Command Injection Metasploit Exploit Title: Sonicwall importlogo/sitecustomization CGI Remote Command Injection Vulnerablity Date: 12/25/2016 Exploit Author: xort @ Critical Start Vendor Homepage: www.sonicwall.com Software Link:...
Fedora 25 : mediawiki (2017-3fb95ed01f)
T109140 T122209 Special:UserLogin and Special:Search allow redirect to interwiki links. CVE-2017-0363, CVE-2017-0364 - T144845 XSS in SearchHighlighter::highlightText when $wgAdvancedSearchHighlighting is true. CVE-2017-0365 - T125177 API parameters may now be marked as 'sensitive' to keep their...
dedeCMS use links to mention the right vulnerability
In the tpl. php /--------------------------- function savetagfile Save the label pieces to modify --------------------------/ else if$action=='savetagfile' if! pregmatch"^a-z0-9-1,. lib.php$i", $filename ShowMsg'file name is not legal, not allowed!', '-1'; exit; requireonceDEDEINC.'/...
act.alz.org Open Redirect vulnerability
Vulnerable URL: https://act.alz.org/site/UserLogin/?logout=1=https://www.openbugbounty.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...
ala.convio.net Open Redirect vulnerability
Vulnerable URL: http://ala.convio.net/site/UserLogin?logout=1=https://www.openbugbounty.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...
SolarWinds Firewall Security Manager 6.6.5 - Client Session Handling (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability", 'Description' = %q This module exploits multiple...
DEBIAN-CVE-2014-7295
The 1 Special:Preferences and 2 Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting XSS attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying...
CVE-2014-7295
The 1 Special:Preferences and 2 Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting XSS attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying...
Debian Security Advisory DSA 3046-1 (mediawiki - security update)
It was reported that MediaWiki, a website engine for collaborative work, allowed to load user-created CSS on pages where user-created JavaScript is not allowed. A wiki user could be tricked into performing actions by manipulating the interface from CSS, or JavaScript code being executed from CSS,...
DEBIAN-CVE-2012-5391
Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid...
DedeCMS 5.7 config.php 跨站脚本漏洞
dedecms 5.7 config.php 跨站脚本漏洞 \include\dialog\config.php $cuserLogin = new userLogin; if$cuserLogin-getUserID 提示：需输入后台管理目录才能登录请输入后台管理目录名：", "javascript:;"; exit; $gurl = "../../$adminDirHand/login.php?gotopage=".urlencode$dedeNowurl; echo "location='$gurl';"; exit; 对用户提交的$adminDirHand...