UBUNTU-CVE-2023-34537

A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data...

PT-2023-25068 · Asus · Asus Rt-N10Lx Router

Name of the Vulnerable Software and Affected Versions: Asus RT-N10LX Router version 2.0.0.39 Description: A stack overflow issue was discovered via the url parameter at the "/start-apply.html" API endpoint. This issue only affects products that are no longer supported by the maintainer...

CVE-2023-28702

ASUS RT-AC86U does not filter special characters for parameters in specific web URLs. A remote attacker with normal user privileges can exploit this vulnerability to perform command injection attack to execute arbitrary system commands, disrupt system or terminate service...

Faculty Evaluation System SQL Injection Vulnerability

Faculty Evaluation System is a faculty evaluation system. Faculty Evaluation System v1.0 suffers from a SQL injection vulnerability, which originates from a SQL injection in /eval/admin/viewfaculty.php?id. An attacker can exploit this vulnerability by inserting SQL commands into the query string ...

Siemens SIPROTEC 5 code issue vulnerabilities

Siemens SIPROTEC 5 is a multifunction relay from Siemens, Germany. A code issue vulnerability exists in the Siemens SIPROTEC 5 that stems from a lack of proper validation of the http request parameters of the hosted web service, which can be exploited by an attacker to send specially crafted...

PT-2023-7478 · Unknown · Osprey Pump Controller

Name of the Vulnerable Software and Affected Versions: Osprey Pump Controller version 1.01 Description: The issue exists due to the failure to neutralize special elements in the DataLogView.php, EventsView.php, and AlarmsView.php scripts of the Osprey Pump Controller software. This allows a remot...

WordPress plugin Fastly has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Changing Information Technology RAVA certificate validation system code issues and vulnerabilities

Changing Information Technology RAVA certificate validation system Panorama Software RAVA certificate validation system website is a certificate validation system from Changing Information Technology, China. A security vulnerability exists in the RAVA certificate validation system, which stems fr...

DEBIAN-CVE-2018-25047

In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smartyfunctionmailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user...

Teledyne FLIR AX8 Operating System Command Injection Vulnerability

Teledyne FLIR AX8 is a series of thermal surveillance cameras from Teledyne FLIR USA. Teledyne FLIR AX8 1.46.16 and earlier versions suffer from an operating system command injection vulnerability that originates from an attacker being able to use root privileges to execute arbitrary commands on...

Passwork password manager Path Traversal

The vulnerability of the Passwork password manager is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor, operating remotely, to manipulate URL parameters in order to gain access to local files and directories on th...

PT-2022-21073 · Totolink · Totolink T6

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.9cu.5179 B20201015 Description: A stack overflow issue was discovered via the url parameter in the function FUN 00418540. This issue can be exploited, potentially leading to unintended consequences. Recommendations: Fo...

CVE-2022-33175

Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/getparam.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrator...

External Control of Assumed-Immutable Web Parameter in moodle

A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field...

GHSA-X6GM-QQWP-76GR External Control of Assumed-Immutable Web Parameter in moodle

A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field...

CVE-2022-30597: External Control of Assumed-Immutable Web Parameter

A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field...

CVE-2021-27769: External Control of Assumed-Immutable Web Parameter

Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that could be used for an attack should be...

CVE-2022-29399

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the url parameter in the function FUN00415bf0...

CVE-2022-27293

D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanSetup. This vulnerability allows attackers to cause a Denial of Service DoS via the webpage parameter...

Cross site scripting

InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scripting XSS vulnerability via the webexec parameter at /apply.cgi...