8 matches found
CVE-2018-19511
wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password...
Cross site scripting
wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars instead of using a templating engine with proper contextual encoding. Because it is possible to insert arbitrary strings into the database, any JavaScript could be executed by the administrator, leading to XSS...
CVE-2018-19511
wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password...
CVE-2018-19511
CVE-2018-19511 concerns Webgalamb 7.0 where wg7.php lacks CSRF protections, demonstrated by using wg7.php?options=1 to change the administrator password. The Red Hat and NVD/NVD-linked records corroborate a CSRF flaw affecting Webgalamb, with no explicit exploit details or patch/version fixes pro...
PT-2019-9843
Name of the Vulnerable Software and Affected Versions Webgalamb version 7.0 Description The issue concerns a lack of security measures to prevent CSRF attacks. This can be demonstrated through the API endpoint "wg7.php?options=1" which allows changing the administrator password. Recommendations F...
CVE-2018-19509: Improper Neutralization of Input During Web Page Generation
wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars instead of using a templating engine with proper contextual encoding. Because it is possible to insert arbitrary strings into the database, any JavaScript could be executed by the administrator, leading to XSS...
CVE-2018-19511: Cross-Site Request Forgery (CSRF)
wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password...
PT-2019-9840
Name of the Vulnerable Software and Affected Versions Webgalamb version 7.0 Description The issue arises from the wg7.php file in Webgalamb, which makes opportunistic calls to htmlspecialchars instead of utilizing a templating engine with proper contextual encoding. This allows for the insertion ...