CVE-2019-19987

CVE-2019-19987 affects Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29.0. The vulnerability is a Cross-Site Request Forgery (CSRF) in the web application’s handling of HTML forms, allowing an attacker to abuse functions such as change password, add user, and add privilege. Root c...

CVE-2019-19988

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. A user with valid credentials is able to create and write XML files on the filesystem via /common/vameditXml.php in the web interface. The vulnerable PHP page checks none of these: the parameter that identifies the...

CVE-2019-19988

The CVE-2019-19988 issue affects Selesta Visual Access Manager (VAM) versions 4.15.0–4.29. An authenticated user can create and write arbitrary files on the filesystem via the web interface, by manipulating the file name, destination path, or extension in /common/vam_editXml.php. The vulnerable p...

CVE-2019-19989

Selesta Visual Access Manager (VAM) versions 4.15.0–4.29 contain an unauthorized access issue where several PHP pages and other file types are reachable without checking user identity or authorization. Root cause: lack of access checks on these pages. Impact: potential exposure of PHP pages or fi...

CVE-2019-19989

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Several PHP pages, and other type of files, are reachable by any user without checking for user identity and authorization...

CVE-2019-19990

CVE-2019-19990 concerns a stored XSS vulnerability in Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29. The issue enables remote authenticated users to inject arbitrary web script/HTML via the pages /monitor/s_headmodel.php and /vam/vam_user.php , due to lack of proper validation ...

CVE-2019-19990

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Multiple Stored Cross-site scripting XSS vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /monitor/sheadmodel.php and /vam/vamuser.php...

CVE-2019-19991

CVE-2019-19991 concerns Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29, where multiple reflected XSS flaws are exploitable by remote authenticated users. The vulnerabilities affect specific web pages: /vam/vam_anagraphic.php, /vam/vam_vamuser.php, /common/vamp_main.php, and /wiz...

CVE-2019-19991

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Multiple Reflected Cross-site scripting XSS vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /vam/vamanagraphic.php, /vam/vamvamuser.php, /common/vampmain.php...

CVE-2019-19992

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. A user with valid credentials is able to read XML files on the filesystem via the web interface. The PHP page /common/vameditXml.php doesn't check the parameter that identifies the file name to be read. Thus, an...

CVE-2019-19992

The CVE refers to Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29. The vulnerability arises from /common/vam_editXml.php not validating the file-name parameter, allowing an authenticated user to read arbitrary XML files from the server filesystem via the web interface. This is a ...

CVE-2019-19993

Selesta Visual Access Manager (VAM) 4.15.0–4.29.x contains a full path disclosure vulnerability. An unauthenticated attacker can send arbitrary content to vulnerable pages, causing error messages that reveal full filesystem paths. Impact described as confidentiality exposure (partial). Root cause...

CVE-2019-19994

The CVE-2019-19994 entry concerns Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29. It describes a vulnerability in the PHP page /common/vam_monitor_sap.php that allows blind command injection. The issue can be exploited by an attacker without authentication to execute arbitrary o...

vam shop 1.69 - Multiple Vulnerabilities

No description provided by source. Product: VaM Shop Vendor: Vamsoft http://vamshop.ru/ Vulnerable Version: 1,69 and probably prior versions. Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level: High Credit: Security Effect Teamhttp://seceffect.tumblr.com/ Vulnerability Details...

vam shop 1.6 - Multiple Vulnerabilities

No description provided by source. Vulnerability ID: HTB22780 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinvamshop.html Product: VaM Shop Vendor: Vamsoft http://vamshop.ru/ Vulnerable Version: 1.6 and Probably Prior Versions Vendor Notification: 28 December 2010 Vulnerability Type: CSRF...

VaM Shop v1.69 - Multiple Web Vulnerabilities

Title: ====== VaM Shop v1.69 - Multiple Web Vulnerabilities Date: ===== 2012-10-24 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=730 VL-ID: ===== 730 Common Vulnerability Scoring System: ==================================== 8.1 Introduction: ============= Vendor...

vam shop 1.69 - Multiple Vulnerabilities

vam shop 1.69 - Multiple Vulnerabilities Product: VaM Shop Vendor: Vamsoft http://vamshop.ru/ Vulnerable Version: 1,69 and probably prior versions. Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level: High Credit: Security Effect Teamhttp://seceffect.tumblr.com/ Vulnerability...

vam shop 1.69 - Multiple Vulnerabilities

Product: VaM Shop Vendor: Vamsoft http://vamshop.ru/ Vulnerable Version: 1,69 and probably prior versions. Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level: High Credit: Security Effect Teamhttp://seceffect.tumblr.com/ Vulnerability Details: 1. Blind SQL injection in...

VaM Shop 1.69 Cross Site Scripting / SQL Injection

Title: ====== VaM Shop v1.69 - Multiple Web Vulnerabilities Date: ===== 2012-10-24 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=730 VL-ID: ===== 730 Common Vulnerability Scoring System: ==================================== 8.1 Introduction: ============= Vendor...

VaM Shop Cross-Site Scripting and Blind SQL Injection Vulnerabilities

Product: VaM Shop Vendor: Vamsoft http://vamshop.ru/ Vulnerable Version: 1,69 and probably prior versions. Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level: High Credit: Security Effect Teamhttp://seceffect.tumblr.com/ Vulnerability Details: 1. Blind SQL injection in...