CVE-2017-6503

WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS...

Cross site scripting

WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS...

CVE-2017-6503

WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS...

CVE-2017-6504

WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking...

CVE-2017-6504

WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking...

CVE-2017-6503

WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS...

CVE-2017-6503

CVE-2017-6503/6504 affect qbittorrent WebUI prior to 3.3.11. The WebUI did not escape many values (CVE-2017-6503), potentially enabling XSS, and did not set X-Frame-Options (CVE-2017-6504), potentially enabling clickjacking. Public advisories from Debian, Fedora, openSUSE and others indicate thes...

CVE-2017-6504

CVE-2017-6504 affects the qBittorrent WebUI prior to 3.3.11, where the application did not set the X-Frame-Options header, potentially enabling clickjacking. Public details in the provided documents confirm the vulnerable component (WebUI), the condition (before 3.3.11), and the impact (clickjack...

CVE-2017-6503

WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS...

CVE-2017-6504

WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking...

CVE-2016-8494

Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme...

Authorization

Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme...

CVE-2016-8494

Fortinet Connect is affected. The issue stems from insufficient verification of uploaded files in the web UI, allowing a webui administrator to upload a new theme that enables arbitrary code execution on the system. The connected Fortinet advisory FG-IR-16-080 confirms the root access potential v...

CVE-2016-8494

Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme...

CVE-2016-8494

Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme...

Fortinet Connect admin able to gain root access

A webui administrator may create a new theme that performs arbitrary code execution on the system...

FortiOS Local Admin Password Hash Leak Vulnerability

A read-only administrator may have access to read-write administrators password hashes not including super-admins stored on the appliance via the webui REST API , and may therefore be able to crack them...

LifeSize Room 5.0.9 - Multiple Vulnerabilities

Source: https://github.com/XiphosResearch/exploits/tree/master/deathsize LifeSize Room 5.0.9, remote config disclosure, code execution & local privilege escalation Ultimately the Lifesize Room products have fundamentally flawed firmware, many similar very bugs in the WebUI exist and thier support...

LifeSize Room 5.0.9 - Multiple Vulnerabilities

LifeSize Room 5.0.9 - Multiple Vulnerabilities Source: https://github.com/XiphosResearch/exploits/tree/master/deathsize LifeSize Room 5.0.9, remote config disclosure, code execution & local privilege escalation Ultimately the Lifesize Room products have fundamentally flawed firmware, many similar...

CVE-2015-7360

FortiSandbox WebUI prior to version 2.1 is vulnerable to multiple cross-site scripting (XSS) flaws. The Flaws allow remote attackers to inject arbitrary script or HTML via: (1) the serial parameter in alerts/summary/profile/; (2) the urlForCreatingReport parameter in csearch/report/export/; (3) t...