Mateusz Goik

A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The issue is due to insufficient input validation. An attacker could exploit this by sending a crafted request to a utility running on an affected system, potentially gaining root privileges.

A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The issue is due to insufficient security controls on the Command Line Interface (CLI). An attacker could exploit this by using an affected CLI utility on an affected system, potentially gaining root privileges.

Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195.

Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194.

Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the `name` or `type` of a function.

The issue allows remote authenticated users to execute arbitrary SQL commands.

The issue allows remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report. This can be achieved through the `summary` or `real name` field.

A cross-site request forgery issue exists, allowing remote attackers to hijack user authentication for modifying bugs. This is achieved through vectors involving a midair-collision token.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report, such as the `Version` field.

The issue allows attackers to execute arbitrary PHP code via unknown vectors.

The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which can lead to cross-site scripting (XSS) attacks.

The issue allows remote attackers to obtain sensitive information via a direct request to `show config errors.php`, which reveals the installation path in an error message when a configuration file does not exist.

A directory traversal issue exists when Mathopd is configured with the * construct for mass virtual hosting, allowing remote attackers to read arbitrary files by sending a crafted Host header.