24 results · Feed
-
Critical 9.2
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed w…
-
High 7.1
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can provide arbitrary values for the…
-
High 8.6
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate thes…
-
High 8.6
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, all…
-
Critical 9.4
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting…
-
Medium 5.4
OCS Inventory NG Server Stored XSS via User-Agent
OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers…
-
Medium 6.9
OCSInventory-ocsreports 2.12.0 - Stored cross-site Scripting
OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.
-
Unscored —
Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain a…
-
Unscored —
Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Invento…
-
Unscored —
OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the c…
-
Unscored —
OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit…
-
Unscored —
OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be …
-
Unscored —
OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in we…
-
Unscored —
OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the OCS Reports Web Interface in OCS Inventory NG allow remote a…
-
Unscored —CVE-2011-4024 Public exploit
Cross-site scripting (XSS) vulnerability in ocsinventory in OCS Inventory NG 2.0.1 and earlier allows remote attackers …
-
Unscored —
Multiple SQL injection vulnerabilities in OCS Inventory NG before 1.02.3 allow remote attackers to execute arbitrary SQ…
-
Unscored —
Multiple SQL injection vulnerabilities in ocsreports/index.php in OCS Inventory NG 1.02.1 allow remote attackers to exe…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in ocsreports/index.php in OCS Inventory NG 1.02.1 allow remote att…
-
Unscored —CVE-2009-3042 Public exploit
SQL injection vulnerability in machine.php in Open Computer and Software (OCS) Inventory NG 1.02.1 allows remote attack…
-
Unscored —CVE-2009-3040 Public exploit
Multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG 1.02 for Unix allow remote atta…
-
Unscored —CVE-2009-2166 Public exploit
Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to r…
-
Unscored —
The web interface in Open Computer and Software Inventory Next Generation (OCS Inventory NG) 1.01 generates different e…
-
Unscored —CVE-2009-1443 Public exploit
Multiple unspecified vulnerabilities in the Server component in OCS Inventory NG before 1.02 have unknown impact and at…