16 results · Feed
-
Critical 9.2
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed w…
-
High 7.1
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can provide arbitrary values for the…
-
High 8.6
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate thes…
-
High 8.6
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, all…
-
Critical 9.4
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting…
-
Medium 5.4
OCS Inventory NG Server Stored XSS via User-Agent
OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers…
-
Medium 6.9
OCSInventory-ocsreports 2.12.0 - Stored cross-site Scripting
OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.
-
High 8.0
Service Hostname Discovery Exploitation in phpCAS
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacke…
-
Unscored —
OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php be…
-
Unscored —
Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain a…
-
Unscored —
OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the c…
-
Unscored —
OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit…
-
Unscored —
OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be …
-
Unscored —
OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in we…
-
Unscored —
OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the OCS Reports Web Interface in OCS Inventory NG allow remote a…