PT-2018-14923

Name of the Vulnerable Software and Affected Versions Google Monorail versions prior to 2018-05-04 Description The issue allows for a Cross-Site Search XS-Search due to CSV downloads being affected by CSRF. Additionally, calculations of download times for requests with an unsupported axis can be...

CVE-2018-10099: Cross-Site Request Forgery (CSRF)

Google Monorail before 2018-04-04 has a Cross-Site Search XS-Search vulnerability because CSV downloads are affected by CSRF, and calculations of download times for requests with duplicated columns can be used to obtain sensitive information about the content of bug reports...

PT-2018-9680

Name of the Vulnerable Software and Affected Versions: Google Monorail versions prior to 2018-04-04 Description: The issue allows for Cross-Site Search XS-Search due to CSV downloads being affected by CSRF. Calculations of download times, particularly for requests with duplicated columns, can be...

PT-2018-14924

Name of the Vulnerable Software and Affected Versions Google Monorail versions prior to 2018-06-07 Description The issue allows for Cross-Site Search XS-Search due to CSV downloads being affected by CSRF. Calculations of download times, specifically for requests with a crafted groupby value, can ...

CVE-2018-19334: Cross-Site Request Forgery (CSRF)

Google Monorail before 2018-05-04 has a Cross-Site Search XS-Search vulnerability because CSV downloads are affected by CSRF, and calculations of download times for requests with an unsupported axis can be used to obtain sensitive information about the content of bug reports...

CVE-2018-19335: Cross-Site Request Forgery (CSRF)

Google Monorail before 2018-06-07 has a Cross-Site Search XS-Search vulnerability because CSV downloads are affected by CSRF, and calculations of download times for requests with a crafted groupby value can be used to obtain sensitive information about the content of bug reports...

CVE-2018-6074

Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls via a crafted HTML page...

UBUNTU-CVE-2018-6074

Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls via a crafted HTML page...

UBUNTU-CVE-2018-6075

Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page and user interaction...

CVE-2018-6075

Chrome 65.0.3325.146+ fixes CVE-2018-6075 (information disclosure via overly permissive cross-origin downloads). Affected product: Google Chrome/Chromium. Root cause: bypass of Same Origin Policy enabling cross-origin data leakage through a crafted HTML page and user interaction. Remediation: upg...

CVE-2018-6075

Removed by vendor...

CVE-2018-6074

Removed by vendor...

CVE-2018-6075: Exposure of Sensitive Information to an Unauthorized Actor

Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page and user interaction...

CVE-2018-6074: Improper Input Validation

Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls via a crafted HTML page...

GHSA-9P47-W5XP-F4XR windows-build-tools downloads Resources over HTTP

Affected versions of windows-build-tools insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution o...

MyBB Downloads 2.0.3 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB Downloads 2.0.3 - SQL Injection Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage: https://github.com/vintagedaddyo/MyBBPlugin-Downloads...

GoUrl Bitcoin Payment Gateway < 1.4.14 - Shell Upload

The GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership WordPress plugin was affected by a Shell Upload security vulnerability...

MyBB Downloads 2.0.3 - SQL Injection

MyBB Downloads 2.0.3 - SQL Injection Exploit Title: MyBB Downloads 2.0.3 - SQL Injection Date: 28-10-2018 Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage: https://github.com/vintagedaddyo/MyBBPlugin-Downloads...

MyBB Downloads 2.0.3 - SQL Injection

Exploit Title: MyBB Downloads 2.0.3 - SQL Injection Date: 28-10-2018 Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage: https://github.com/vintagedaddyo/MyBBPlugin-Downloads Software Link:...

MyBB Downloads 2.0.3 SQL Injection

Exploit Title: MyBB Downloads 2.0.3 - SQL Injection Date: 28-10-2018 Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage: https://github.com/vintagedaddyo/MyBBPlugin-Downloads Software Link:...