engineercms cross-site scripting vulnerability

engineercms is an open source engineer knowledge management system . Specifically for civil engineers to create a suitable web-based knowledge management system . It can be used to manage both individual project information , but also for managing project team information ; it can run on both...

Piwigo Cross-Site Scripting Vulnerability (CNVD-2021-54383)

Piwigo is a set of Web-based open source photo gallery software. Piwigo version 2.10.1 has a cross-site scripting vulnerability that allows attackers to execute arbitrary Web scripts or HTML...

CVE-2021-1618

Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to insufficient input validation. An...

CVE-2021-1599

A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to perform a cross-site scripting XSS attack against a user. This vulnerability is due to insufficient input validation of a parameter that is used by the...

Path traversal

Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to insufficient input validation. An...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to perform a cross-site scripting XSS attack against a user. This vulnerability is due to insufficient input validation of a parameter that is used by the...

Path traversal

Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to insufficient input validation. An...

CVE-2021-1599

Cisco CVP's web-based management interface is affected by CVE-2021-1599 via insufficient input validation of a parameter, enabling an authenticated remote attacker to perform cross-site scripting. Exploitation could lead to arbitrary code execution in the interface, access to browser-based data, ...

CVE-2021-1599 Cisco Unified Customer Voice Portal Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to perform a cross-site scripting XSS attack against a user. This vulnerability is due to insufficient input validation of a parameter that is used by the...

CVE-2021-1617 Cisco Intersight Virtual Appliance Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to insufficient input validation. An...

CVE-2021-1617 Cisco Intersight Virtual Appliance Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to insufficient input validation. An...

CVE-2021-1617

Cisco Intersight Virtual Appliance (CVE-2021-1617) suffers from path traversal and command-injection vulnerabilities due to insufficient input validation in the web-based management interface. An authenticated remote attacker could use crafted input to read/write arbitrary files or execute comman...

CVE-2021-1618

CVE-2021-1618 affects Cisco Intersight Virtual Appliance. Vulnerabilities in the web-based management interface allow authenticated, remote attackers to perform path traversal or command injection due to insufficient input validation. Impact per sources: reads/writes of arbitrary files and possib...

CVE-2021-1618 Cisco Intersight Virtual Appliance Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to insufficient input validation. An...

CVE-2021-1618: Absolute Path Traversal

Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to insufficient input validation. An...

CVE-2021-1599: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to perform a cross-site scripting XSS attack against a user. This vulnerability is due to insufficient input validation of a parameter that is used by the...

Tecnick.com TCExam information leakage vulnerability

Tecnick.com TCExam is a Web-based open source e-exam system from Tecnick.com, UK. The system is mainly used for online exams, etc. TCExam suffers from an information disclosure vulnerability that can be exploited by a remote attacker to gain unauthorized access to sensitive system information...

CVE-2021-32775

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0...

CVE-2021-32775

CVE-2021-32775 (Combodo iTop) : An information disclosure in iTop prior to versions 2.7.4 and 3.0.0 allowed a non-admin user to view many class/field values via a GroupBy Dashlet error message. The issue is fixed in 2.7.4 and 3.0.0. Affected product details and exact root cause are described in t...

CVE-2021-21406

CVE-2021-21406 affects Combodo iTop, a web-based IT service management tool. In versions before 2.7.4, there is a command injection vulnerability in the Setup Wizard triggered by providing the Graphviz executable path. Root cause is input handling in the setup flow that allows executing system co...