| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-4011 | Hig | 0.49 | 7.5 | 0.01 | Mar 21, 2019 | An exploitable integer underflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall, version 7003. When parsing SRV records in an mDNS packet, the "RDLENGTH" value is handled incorrectly, leading to an out-of-bounds access that crashes the mdnscap process. An… | ||
| CVE-2018-4003 | Cri | 0.64 | 9.8 | 0.02 | Mar 21, 2019 | An exploitable heap overflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. The string lengths are handled incorrectly when parsing character strings in mDNS resource records, leading to arbitrary code execution in the context of the… | ||
| CVE-2018-3985 | Cri | 0.64 | 9.8 | 0.02 | Mar 21, 2019 | An exploitable double free vulnerability exists in the mdnscap binary of the CUJO Smart Firewall. When parsing mDNS packets, a memory space is freed twice if an invalid query name is encountered, leading to arbitrary code execution in the context of the mdnscap process. An… | ||
| CVE-2018-3969 | Hig | 0.51 | 7.8 | 0.01 | Mar 21, 2019 | An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall. It is possible to add arbitrary shell commands into the dhcpd.conf file, that persist across reboots and firmware updates, and thus allow for executing unverified commands. To trigger… | ||
| CVE-2018-3963 | Hig | 0.52 | 8.0 | 0.03 | Mar 21, 2019 | An exploitable command injection vulnerability exists in the DHCP daemon configuration of the CUJO Smart Firewall. When adding a new static DHCP address, its corresponding hostname is inserted into the dhcpd.conf file without prior sanitization, allowing for arbitrary execution… | ||
| CVE-2019-9898 | Cri | 0.64 | 9.8 | 0.04 | Mar 21, 2019 | Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71. | ||
| CVE-2019-9897 | Hig | 0.49 | 7.5 | 0.03 | Mar 21, 2019 | Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71. | ||
| CVE-2019-9896 | Hig | 0.51 | 7.8 | 0.01 | Mar 21, 2019 | In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable. | ||
| CVE-2019-9895 | Cri | 0.64 | 9.8 | 0.03 | Mar 21, 2019 | In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding. | ||
| CVE-2019-9894 | Hig | 0.49 | 7.5 | 0.02 | Mar 21, 2019 | A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification. | ||
| CVE-2019-9893 | Cri | 0.64 | 9.8 | 0.03 | Mar 21, 2019 | libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations. | ||
| CVE-2019-9889 | Low | 0.18 | 2.7 | 0.02 | Mar 21, 2019 | In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code… | ||
| CVE-2019-9878 | Hig | 0.51 | 7.8 | 0.01 | Mar 21, 2019 | There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf 4.0.0, as used in pdfalto 0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of… | ||
| CVE-2019-9877 | Hig | 0.51 | 7.8 | 0.01 | Mar 21, 2019 | There is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf 4.01, which can (for example) be triggered by sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation… | ||
| CVE-2019-9870 | Cri | 0.64 | 9.8 | 0.02 | Mar 21, 2019 | plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements. | ||
| CVE-2019-9868 | Hig | 0.47 | 7.2 | 0.01 | Mar 21, 2019 | An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator. | ||
| CVE-2019-9867 | Hig | 0.47 | 7.2 | 0.01 | Mar 21, 2019 | An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is displayed to an administrator. | ||
| CVE-2019-9857 | Med | 0.36 | 5.5 | 0.00 | Mar 21, 2019 | In the Linux kernel through 5.0.2, the function inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c neglects to call fsnotify_put_mark() with IN_MASK_CREATE after fsnotify_find_mark(), which will cause a memory leak (aka refcount leak). Finally, this will cause a… | ||
| CVE-2019-9837 | Med | 0.40 | 6.1 | 0.01 | Mar 21, 2019 | Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This… | ||
| CVE-2019-9094 | Med | 0.40 | 6.1 | 0.01 | Mar 21, 2019 | A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing JavaScript in the filename is echoed back in JavaScript code, which resulted in XSS. | ||
| CVE-2019-9093 | Med | 0.40 | 6.1 | 0.01 | Mar 21, 2019 | A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing a JavaScript payload in the filename parameter is echoed back, which resulted in reflected XSS. | ||
| CVE-2019-9083 | Cri | 0.68 | 9.8 | 0.18 | Mar 21, 2019 | SQLiteManager 1.20 and 1.24 allows SQL injection via the /sqlitemanager/main.php dbsel parameter. NOTE: This product is discontinued. | ||
| CVE-2019-8938 | Med | 0.40 | 6.1 | 0.02 | Mar 21, 2019 | VertrigoServ 2.17 allows XSS via the /inc/extensions.php ext parameter. | ||
| CVE-2019-8934 | Low | 0.21 | 3.3 | 0.01 | Mar 21, 2019 | hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest. | ||
| CVE-2019-7441 | Med | 0.46 | 6.5 | 0.06 | Mar 21, 2019 | cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it… | ||
| CVE-2019-7440 | Med | 0.45 | 6.5 | 0.02 | Mar 21, 2019 | JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi). | ||
| CVE-2019-7439 | Med | 0.46 | 6.5 | 0.05 | Mar 21, 2019 | cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter. | ||
| CVE-2019-7438 | Med | 0.43 | 6.1 | 0.04 | Mar 21, 2019 | cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter. | ||
| CVE-2019-7437 | Med | 0.40 | 6.1 | 0.01 | Mar 21, 2019 | PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected Cross-Site Scripting (XSS) via the Search field. | ||
| CVE-2019-7436 | Med | 0.42 | 6.5 | 0.01 | Mar 21, 2019 | PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory. | ||
| CVE-2019-7435 | Med | 0.35 | 5.3 | 0.01 | Mar 21, 2019 | PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected HTML injection via the Search Form. | ||
| CVE-2019-7434 | Med | 0.42 | 6.5 | 0.01 | Mar 21, 2019 | PHP Scripts Mall Rental Bike Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory. | ||
| CVE-2019-7433 | Hig | 0.57 | 8.8 | 0.01 | Mar 21, 2019 | PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature. | ||
| CVE-2019-7432 | Med | 0.35 | 5.4 | 0.01 | Mar 21, 2019 | PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section. | ||
| CVE-2019-7431 | Med | 0.42 | 6.5 | 0.01 | Mar 21, 2019 | PHP Scripts Mall Image Sharing Script 1.3.4 has directory traversal via a direct request for a listing of an uploads directory. | ||
| CVE-2019-7430 | Med | 0.35 | 5.3 | 0.01 | Mar 21, 2019 | PHP Scripts Mall Image Sharing Script 1.3.4 has HTML injection via the Search Bar. | ||
| CVE-2019-7429 | Med | 0.42 | 6.5 | 0.01 | Mar 21, 2019 | PHP Scripts Mall Property Rental Software 2.1.4 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2016/08 directory. | ||
| CVE-2019-7425 | Med | 0.40 | 6.1 | 0.03 | Mar 21, 2019 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task parameter. | ||
| CVE-2019-7424 | Med | 0.40 | 6.1 | 0.03 | Mar 21, 2019 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or any of these POST parameters: autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName. The latter is… | ||
| CVE-2019-7423 | Med | 0.40 | 6.1 | 0.03 | Mar 21, 2019 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userName parameter. | ||
| CVE-2019-7422 | Med | 0.40 | 6.1 | 0.03 | Mar 21, 2019 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter. | ||
| CVE-2019-7421 | Med | 0.40 | 6.1 | 0.02 | Mar 21, 2019 | XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.login/gnb/loginView.sws" in multiple parameters: contextpath and basedURL. | ||
| CVE-2019-7420 | Med | 0.40 | 6.1 | 0.02 | Mar 21, 2019 | XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.application/information/networkinformationView.sws" in the tabName parameter. | ||
| CVE-2019-7419 | Med | 0.40 | 6.1 | 0.02 | Mar 21, 2019 | XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/leftmenu.sws" in multiple parameters: ruiFw_id, ruiFw_pid, ruiFw_title. | ||
| CVE-2019-7418 | Med | 0.40 | 6.1 | 0.02 | Mar 21, 2019 | XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/swsAlert.sws" in multiple parameters: flag, frame, func, and Nfunc. | ||
| CVE-2019-7417 | Med | 0.40 | 6.1 | 0.01 | Mar 21, 2019 | XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB, FN, fn, or id parameter. | ||
| CVE-2019-7416 | Med | 0.40 | 6.1 | 0.02 | Mar 21, 2019 | XSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. The parameter startat in "/webtop/help/en/default.htm" is vulnerable. | ||
| CVE-2019-7391 | Hig | 0.61 | 8.8 | 0.14 | Mar 21, 2019 | ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF. | ||
| CVE-2019-7386 | Med | 0.43 | 6.5 | 0.04 | Mar 21, 2019 | A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices. When a crafted web page is visited with the internal browser, the Gecko process crashes with a segfault. Successful exploitation could lead to the… | ||
| CVE-2019-7385 | Hig | 0.55 | 7.8 | 0.12 | Mar 21, 2019 | An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below, The values of the newpass and confpass parameters in… |
- risk 0.49cvss 7.5epss 0.01
An exploitable integer underflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall, version 7003. When parsing SRV records in an mDNS packet, the "RDLENGTH" value is handled incorrectly, leading to an out-of-bounds access that crashes the mdnscap process. An…
- risk 0.64cvss 9.8epss 0.02
An exploitable heap overflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. The string lengths are handled incorrectly when parsing character strings in mDNS resource records, leading to arbitrary code execution in the context of the…
- risk 0.64cvss 9.8epss 0.02
An exploitable double free vulnerability exists in the mdnscap binary of the CUJO Smart Firewall. When parsing mDNS packets, a memory space is freed twice if an invalid query name is encountered, leading to arbitrary code execution in the context of the mdnscap process. An…
- risk 0.51cvss 7.8epss 0.01
An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall. It is possible to add arbitrary shell commands into the dhcpd.conf file, that persist across reboots and firmware updates, and thus allow for executing unverified commands. To trigger…
- risk 0.52cvss 8.0epss 0.03
An exploitable command injection vulnerability exists in the DHCP daemon configuration of the CUJO Smart Firewall. When adding a new static DHCP address, its corresponding hostname is inserted into the dhcpd.conf file without prior sanitization, allowing for arbitrary execution…
- risk 0.64cvss 9.8epss 0.04
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.
- risk 0.49cvss 7.5epss 0.03
Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.
- risk 0.51cvss 7.8epss 0.01
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable.
- risk 0.64cvss 9.8epss 0.03
In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding.
- risk 0.49cvss 7.5epss 0.02
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.
- risk 0.64cvss 9.8epss 0.03
libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.
- risk 0.18cvss 2.7epss 0.02
In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code…
- risk 0.51cvss 7.8epss 0.01
There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf 4.0.0, as used in pdfalto 0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of…
- risk 0.51cvss 7.8epss 0.01
There is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf 4.01, which can (for example) be triggered by sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation…
- risk 0.64cvss 9.8epss 0.02
plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements.
- risk 0.47cvss 7.2epss 0.01
An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator.
- risk 0.47cvss 7.2epss 0.01
An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is displayed to an administrator.
- risk 0.36cvss 5.5epss 0.00
In the Linux kernel through 5.0.2, the function inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c neglects to call fsnotify_put_mark() with IN_MASK_CREATE after fsnotify_find_mark(), which will cause a memory leak (aka refcount leak). Finally, this will cause a…
- risk 0.40cvss 6.1epss 0.01
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This…
- risk 0.40cvss 6.1epss 0.01
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing JavaScript in the filename is echoed back in JavaScript code, which resulted in XSS.
- risk 0.40cvss 6.1epss 0.01
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing a JavaScript payload in the filename parameter is echoed back, which resulted in reflected XSS.
- risk 0.68cvss 9.8epss 0.18
SQLiteManager 1.20 and 1.24 allows SQL injection via the /sqlitemanager/main.php dbsel parameter. NOTE: This product is discontinued.
- risk 0.40cvss 6.1epss 0.02
VertrigoServ 2.17 allows XSS via the /inc/extensions.php ext parameter.
- risk 0.21cvss 3.3epss 0.01
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
- risk 0.46cvss 6.5epss 0.06
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it…
- risk 0.45cvss 6.5epss 0.02
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi).
- risk 0.46cvss 6.5epss 0.05
cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.
- risk 0.43cvss 6.1epss 0.04
cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter.
- risk 0.40cvss 6.1epss 0.01
PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected Cross-Site Scripting (XSS) via the Search field.
- risk 0.42cvss 6.5epss 0.01
PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory.
- risk 0.35cvss 5.3epss 0.01
PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected HTML injection via the Search Form.
- risk 0.42cvss 6.5epss 0.01
PHP Scripts Mall Rental Bike Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory.
- risk 0.57cvss 8.8epss 0.01
PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
- risk 0.35cvss 5.4epss 0.01
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section.
- risk 0.42cvss 6.5epss 0.01
PHP Scripts Mall Image Sharing Script 1.3.4 has directory traversal via a direct request for a listing of an uploads directory.
- risk 0.35cvss 5.3epss 0.01
PHP Scripts Mall Image Sharing Script 1.3.4 has HTML injection via the Search Bar.
- risk 0.42cvss 6.5epss 0.01
PHP Scripts Mall Property Rental Software 2.1.4 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2016/08 directory.
- risk 0.40cvss 6.1epss 0.03
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task parameter.
- risk 0.40cvss 6.1epss 0.03
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or any of these POST parameters: autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName. The latter is…
- risk 0.40cvss 6.1epss 0.03
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userName parameter.
- risk 0.40cvss 6.1epss 0.03
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter.
- risk 0.40cvss 6.1epss 0.02
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.login/gnb/loginView.sws" in multiple parameters: contextpath and basedURL.
- risk 0.40cvss 6.1epss 0.02
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.application/information/networkinformationView.sws" in the tabName parameter.
- risk 0.40cvss 6.1epss 0.02
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/leftmenu.sws" in multiple parameters: ruiFw_id, ruiFw_pid, ruiFw_title.
- risk 0.40cvss 6.1epss 0.02
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/swsAlert.sws" in multiple parameters: flag, frame, func, and Nfunc.
- risk 0.40cvss 6.1epss 0.01
XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB, FN, fn, or id parameter.
- risk 0.40cvss 6.1epss 0.02
XSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. The parameter startat in "/webtop/help/en/default.htm" is vulnerable.
- risk 0.61cvss 8.8epss 0.14
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
- risk 0.43cvss 6.5epss 0.04
A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices. When a crafted web page is visited with the internal browser, the Gecko process crashes with a segfault. Successful exploitation could lead to the…
- risk 0.55cvss 7.8epss 0.12
An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below, The values of the newpass and confpass parameters in…