691 matches found
CVE-2017-7799
JavaScript in the "about:webrtc" page is not sanitized properly being assigned to "innerHTML". Data on this page is supplied by WebRTC usage and is not under third-party control, making this difficult to exploit, but the vulnerability could possibly be used for a cross-site scripting XSS attack...
CVE-2017-5391
Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a content-injection bug were found in one of those pages this could allow for potential privilege escalation. This vulnerability affects Firefox 51...
Design/Logic Flaw
WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security checks that disallow this behavior. This vulnerability affects Firefox 56...
CVE-2018-5135
WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts where this should not be allowed, such as pages from other WebExtensions or unprivileged "about:" pages. This vulnerability affects Firefox 59...
Schools Alert Management Script - SQL Injection
Exploit Title: Schools Alert Management Script - SQL Injection Date: 2018-06-07 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web Application Exploit Author: M3@Pandas Web:...
CVE-2017-5391: Undefined Security Weakness
Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a content-injection bug were found in one of those pages this could allow for potential privilege escalation. This vulnerability affects Firefox 51...
CVE-2017-7816: Improper Input Validation
WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security checks that disallow this behavior. This vulnerability affects Firefox 56...
PHPMyWind Cross-Site Scripting Vulnerability (CNVD-2018-15387)
PHPMyWind is a PHP + MySQL based development , W3C compliant site building engine for enterprise-level site building . A cross-site scripting vulnerability exists in PHPMyWind version 5.5. A remote attacker can exploit this vulnerability by sending the 'cid' parameter to the newsshow.php page or ...
CVE-2018-11487
PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php...
CLI and UI allow non-admin users to enumerate installed plugins
Users with Overall/Read permission were able use the list-plugins CLI command and view the About Jenkins page to list all installed plugins. Use of the list-plugins CLI command and access to the About Jenkins page now require Overall/Administer permission...
about-payments.com XSS vulnerability
Open Bug Bounty ID: OBB-605493 Description| Value ---|--- Affected Website:| about-payments.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
PT-2018-9701
Name of the Vulnerable Software and Affected Versions: PbootCMS version 0.9.8 Description: The issue allows PHP code injection via an IF label in specific endpoints, such as "index.php/About/6.html" or "admin.php/Site/index.html". This is related to the parserIfLabel function in the...
about-tea.de XSS vulnerability
Open Bug Bounty ID: OBB-601645 Description| Value ---|--- Affected Website:| about-tea.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
SQL Injection Vulnerability in about.asp page of Ebay's website builder system
Ltd. is a brand of Jinan Dotchuang Network Technology Co., Ltd, which is a high-tech network and software technology service provider and operator in Shandong Province. SQL injection vulnerability exists in the about.asp page of Ebay's website building system, which can be exploited by attackers ...
UBUNTU-CVE-2018-5134
WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictions that only allow WebExtensions to view specific content. This vulnerability affects Firefox 59...
Mozilla Firefox Content Restriction Bypass Vulnerability
Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. A content restriction bypass vulnerability exists in Mozilla Firefox. A remote user can invoke the 'view-source:' URL to bypass content restrictions and view potentially sensitive information i...
Progress Sitefinity Cross-Site Scripting Vulnerability (CNVD-2018-05684)
Progress Sitefinity is an open source platform for building corporate websites and intranets. A cross-site scripting vulnerability exists in Progress Sitefinity version 9.1. The vulnerability can be exploited by remote attackers to inject malicious JavaScript code via the Last name, First name, a...
CVE-2017-18177
Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1...
CVE-2017-18177: Improper Neutralization of Input During Web Page Generation
Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1...
