CVE-2017-8051

CVE-2017-8051 affects Tenable Appliance 3.5–4.4.0 (and possibly earlier) via the simpleupload.py Web UI. The flaw allows arbitrary command execution by manipulating the tns_appliance_session_user parameter, enabling unauthenticated, remote code execution as described in multiple sources (e.g., Re...

CVE-2017-8050

Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

Tenable Appliance < 4.5.0 Web UI simpleupload.py Remote Command Execution (CVE-2017-8051)

The remote Tenable Appliance host is affected by a remote command execution vulnerability in the web user interface in the simpleupload.py script due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via the 'tnsappliancesessionuser' parameter, t...

CVE-2016-9980

IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

CVE-2016-9979

IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

Cross site scripting

IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

Cross site scripting

IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

CVE-2016-9980

CVE-2016-9980 affects IBM Cúram Social Program Management and is due to improper validation of user input, allowing cross-site scripting in the Web UI. Affected versions span IBM Cúram SPM 5.2 SP6, 6.0.x (including 6.0.0–6.0.5.x), 6.1.x (6.1.0–6.1.1.x), 6.2.x (6.2.0.0–6.2.0.4), and 7.0.x (7.0.0.0...

CVE-2016-9979

IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

CVE-2016-9980

IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

CVE-2016-4847

Cross-site scripting XSS vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web script or HTML by leveraging an unanchored regex...

CVE-2016-4847

Cross-site scripting XSS vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web script or HTML by leveraging an unanchored regex...

CVE-2016-4847

Cross-site scripting XSS vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web script or HTML by leveraging an unanchored regex...

CVE-2016-4847

CVE-2016-4847 concerns OSSEC Web UI, where site/search.php is vulnerable to cross-site scripting due to an unanchored regex. Affected product: OSSEC Web UI prior to version 0.9. The root cause is an unanchored regex that allows injection of arbitrary script/HTML. Documented impact: arbitrary scri...