3943 matches found
CVE-2018-19927
Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zFormsavechanges sipnick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases...
2018.ecnp.eu XSS vulnerability
Open Bug Bounty ID: OBB-707786 Description| Value ---|--- Affected Website:| 2018.ecnp.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...
Code execution vulnerability in vaeThink php backend
vaeThink is a lightweight, high speed PHP content management framework built on Layui and tp5. A code execution vulnerability exists in the vaeThink php backend. The vulnerability stems from the website's failure to filter php code resulting in arbitrary php code execution, writing a one-sentence...
CVE-2018-11347
The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response from the server, one or several HTTP Header. It requires an interaction with the user to send him the malicious link. It could be used to...
Drobo 5N2 Cross-Site Scripting Vulnerability
The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. A cross-site scripting vulnerability exists in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115. A remote attacker can...
Cisco Prime License Manager SQL Injection Vulnerability
Cisco Prime License Manager PLM is a license manager from Cisco USA. A SQL injection vulnerability exists in the web framework code in Cisco PLM version 11.0.1 and later, which stems from a failure to properly validate user-submitted input in an SQL query statement. A remote attacker can exploit...
FAST or Burp or both?
By @aLLy , Wallarm Research Hello guys, time to talk details about Wallarm FAST Framework for Application Security Testing. It’s a new automatic web vulnerability scanning and fuzzing detection tool by Wallarm Inc. It is well suited for security researchers in enterprise Red Teams as well as for...
CVE-2018-14892
Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow attackers to perform state-changing actions via crafted HTTP forms...
Nagios XI Cross-Site Scripting Vulnerability (CNVD-2018-23143)
Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A cross-site scripting vulnerability exists in Nagios XI 5.5.6. A remote, unauthenticated attacker can exploit this vulnerability via...
PHPCMS Code Injection Vulnerability
PHPCMS is a website content management system based on PHP and Mysql architecture, which includes modules such as news, pictures, downloads, information and products. A code injection vulnerability exists in PHPCMS 2008, which can be exploited to write arbitrary content to the website cache and...
LAOBANCMS Administrator Password Reset Vulnerability
Laoban CMS LAOBANCMS content management system is based on PHP + MYSQL environment developed by the old class of open-source website building system . LAOBANCMS 2.0 has an administrator password reset vulnerability. Attackers can use this vulnerability to reset the administrator password even if...
LAOBANCMS cross-site scripting vulnerability (CNVD-2018-23076)
Laoban CMS LAOBANCMS content management system is based on PHP + MYSQL environment developed by the old class of open-source website building system . LAOBANCMS 2.0 suffers from a cross-site scripting vulnerability. Attackers can use the vulnerability through the admin/liuyan.php neirong paramete...
CVE-2018-18830
An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...
Fastspot Bigtree Session Fixation Vulnerability
Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A session fixation vulnerability exists in Fastspot Bigtree that stems from the fact that after a user logs into the application, the admin.php file receives the PHP session ID...
Hiroshi Yuki YukiWiki Cross-Site Scripting Vulnerability
Hiroshi Yuki YukiWiki is a Wiki engine. A cross-site scripting vulnerability exists in Hiroshi Yuki YukiWiki 2.1.3 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary script in a user's web browser...
CVE-2018-18579
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...
be.fluid-it.reactive-microservice.bundle:bootique-vertx (>=0.1-0 <=0.1-8), be.fluid-it.reactive-microservice.bundle:reactive-microservice-bundle-core (>=0.1-0 <=0.1-8) +525 more potentially affected by CVE-2018-12540 via io.vertx:vertx-web (>=3.0.0 <=3.5.2.CR3)
io.vertx:vertx-web MAVEN version =3.0.0, =0.1-0, =0.1-0, =1.2.1, =3.0.5, =1.0.0, =0.4.2, =0.4.2, =0.4.2, =0.4.2, =0.4.2, =0.4.5 and more Source cves: CVE-2018-12540 Source advisory: OSV:GHSA-RVGG-F8QM-6H7J...
CVE-2018-18433
An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the categorycatname parameter to the admin.php URI...
Acunetix Web Vulnerability Scanner 10 *.slg Buffer Overflow (PoC) Exploit
Exploit for windows platform in category dos / poc Exploit Title: Acunetix Web Vulnerability Scanner 10 ".slg" Buffer Overflow PoC Author: Kağan Çapar Software Link: https://s3.amazonaws.com/a280ccaaf904330a389db759e6275285/acunetixtrial.exe Vendor Homepage : https://www.acunetix.com Tested...