rittal.com XSS vulnerability

Vulnerable URL: https://www.rittal.com/com-en/content/en/support/downloads/Downloads.jsp?category=6/45=%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:|...

Process Hacker DLL Hijacking

Hi Wen Jia, You probably heart about the Java issue which affected their installer. http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0603-2874360.html However this issue also affects multiple other installers as a security researcher has shown...

Wordpress SS Downloads 插件-emailform.php文件-跨站脚本漏洞

No description provided by source...

The vulnerability of the Safari browser, which allows a hacker to trigger a service failure

The vulnerability of the Downloads function in the Safari browser is related to an incorrect file extension. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service interruptions through a specially crafted website...

Free Mp3 Downloads - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Free Mp3 Downloads published at the 'play' market has multiple vulnerabilities...

CVE-2016-1771

The Downloads feature in Apple Safari before 9.1 mishandles file expansion, which allows remote attackers to cause a denial of service via a crafted web site...

CVE-2016-1771

The Downloads feature in Apple Safari before 9.1 mishandles file expansion, which allows remote attackers to cause a denial of service via a crafted web site...

CVE-2016-1771

The Downloads feature in Apple Safari before 9.1 mishandles file expansion, which allows remote attackers to cause a denial of service via a crafted web site...

CVE-2016-1771

CVE-2016-1771 affects Apple Safari’s Downloads feature prior to 9.1. The vulnerability is caused by insufficient validation during file expansion, allowing a crafted web page to trigger a denial of service. Affected product is Safari (pre-9.1) on macOS; impact is denial of service via remote site...

Apple Safari Safari Downloads Denial of Service Vulnerability

Apple Safari is a web browser from Apple and is the default browser that comes with the Mac OS X and iOS operating systems.Safari Downloads is one of the download management plug-ins available. A security vulnerability exists in Safari Downloads in versions of Apple Safari prior to 9.1. The...

CVE-2016-1771: Undefined Security Weakness

The Downloads feature in Apple Safari before 9.1 mishandles file expansion, which allows remote attackers to cause a denial of service via a crafted web site...

PT-2016-1537

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 9.1 Description The issue is related to the incorrect handling of file expansion in the Downloads feature of Apple Safari, allowing remote attackers to cause a denial of service via a specially crafted web site...

CVE-2016-1991

HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to conduct unspecified "file download" attacks via unknown vectors...

FreeBSD : PuTTY - old-style scp downloads may allow remote code execution (7f0fbb30-e462-11e5-a3f3-080027ef73ec)

Simon G. Tatham reports : Many versions of PSCP prior to 0.67 have a stack corruption vulnerability in their treatment of the 'sink' direction i.e. downloading from server to client of the old-style SCP protocol. In order for this vulnerability to be exploited, the user must connect to a maliciou...

Putty 0.66 DLL Hijacking

Hi, putty-0.66-installer.exe loads and executes DWMAPI.dll or UXTheme.dll from its "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see , and for "prior art" about this well-known and well-documented...

Easy Digital Downloads <= 2.5.7 - PHP Object Injection

Easy Digital Downloads unserializes user-submitted data from cookies and other request parameters, allowing for object injection...

WordPress Easy Digital Downloads Plugin <= 2.5.7 - PHP Object Injection

Because of this vulnerability, attackers can execute arbitrary PHP code. Solution Upgrade the plugin...

Cygwin DLL Hijacking

Hi @ll, Cygwin's setup-x86.exe loads and executes UXTheme.dll on Windows XP also ClbCatQ.dll and some more DLLs from its "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see , and If UXTheme.dll or one of...

GIMP For Windows DLL Hijacking

Hi @ll, the executable installer gimp-2.8.16-setup-1.exe and of course older versions too available from loads and executes UXTheme.dll from its "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see , and...

The software of the Advantech WebAccess remote monitoring system is vulnerable, allowing a intruder to modify files of any type.

The vulnerability of Advantech WebAccess remote monitoring software lies in the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to modify files of any type remotely...