7065 matches found
PT-2019-7438
Name of the Vulnerable Software and Affected Versions ACF-Frontend-Display plugin through 2015-07-03 for WordPress Description The issue allows for arbitrary file upload via an action=upload request to "js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php". Recommendations For versions of t...
CVE-2015-9479: Unrestricted Upload of File with Dangerous Type
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php...
CVE-2019-17426: Undefined Security Weakness
Automattic Mongoose through 5.7.4 allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around...
PT-2019-7437
Name of the Vulnerable Software and Affected Versions prettyPhoto versions prior to 3.1.6 Description The issue is related to an XSS in the js/jquery.prettyPhoto.js file. Recommendations For versions prior to 3.1.6, update to version 3.1.6 or later to resolve the issue...
CVE-2015-9478: Improper Neutralization of Input During Web Page Generation
prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS...
Prototype Pollution
react-particles-js is vulnerable to prototype pollution attacks. Attackers can manipulates attributes to overwrite, or pollute existing properties relating to an Object by injecting malicious values through proto attribute . Using this flaw the attackers can trigger denial of service DoS attacks...
js jobs,1.1.5, 1.1.6, 1.2.5 and 1.2.6,Other
js jobs,1.1.5, 1.1.6, 1.2.5 and 1.2.6,Other Extension Update Details Fix the file security bug. new version number 2.1.7...
PRODSECBUG-2447: Using JS libraries with known security vulnerabilities
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
U.S. Dept Of Defense: [█████] — DOM-based XSS on endpoint `/?s=`
Description GET parameter s is vulnerable to DOM-based XSS on endpoint /?s=. XSS affects all users and no authentication or login is required. Proof of Concept Visit the following URL for PoC: https://██████/?s=%27%3E%3Cscript%3Ealertdocument.domain%3C/script%3E █████████ Explanation This DOM-bas...
WebKit - Universal XSS Using Cached Pages Exploit
VULNERABILITY DETAILS void FrameLoader::detachChildren ... SubframeLoadingDisabler subframeLoadingDisablermframe.document; // 1 Vector, 16 childrenToDetach; childrenToDetach.reserveInitialCapacitymframe.tree.childCount; for Frame child = mframe.tree.lastChild; child; child =...
WebKit - Universal XSS Using Cached Pages
WebKit - Universal XSS Using Cached Pages VULNERABILITY DETAILS void FrameLoader::detachChildren ... SubframeLoadingDisabler subframeLoadingDisablermframe.document; // 1 Vector, 16 childrenToDetach; childrenToDetach.reserveInitialCapacitymframe.tree.childCount; for Frame child =...
PT-2019-14751
Name of the Vulnerable Software and Affected Versions ThinkSAAS version 2.91 Description An issue was discovered where there is a potential for XSS via the content to the "index.php?app=group&ac=comment&ts=do&js=1" URI. This can be demonstrated by a crafted SVG document in the SRC attribute of an...
wbNj8EIMfXlmDDE
A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...
@agrc/helpers (>=1.0.0, <=1.0.1), @dojo/interop (>=4.0.0-alpha.1, <=7.0.0) +3 more potentially affected by CVE-2010-2273 via dojo (1.13.0)
dojo NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojo and may be impacted: - @agrc/helpers =1.0.0, =4.0.0-alpha.1, =0.1.10, =0.1.12 - dijit 1.13.0 - dojox 1.13.0 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...
WordPress <= 5.2.2 - Cross-Site Scripting (XSS) in URL Sanitisation
Description According to the WordPress release notes: "Props to Soroush Dalili @irsdl from NCC Group for disclosing an issue with URL sanitization that can lead to cross-site scripting XSS attacks." Thanks to @irsdl's Hacker1 disclosure: JS - Numerical Entities JS - Hex Entities...
Local File Inclusion
larvitbase-www is vulnerable to local file inclusion. The package uses an exposed API endpoint that accepts an unvalidated GET parameter to a require function call. This could potentially allow a remote attacker to execute any .js files within the web server. Successful exploitation causes the...
Sentrifugo 3.2 - Persistent Cross-Site Scripting
Sentrifugo 3.2 - Persistent Cross-Site Scripting Exploit Title: Sentrifugo 3.2 - Persistent Cross-Site Scripting Google Dork: N/A Date: 8/29/2019 Exploit Author: creosote Vendor Homepage: http://www.sentrifugo.com/ Version: 3.2 Tested on: Ubuntu 18.04 CVE : CVE-2019-15814 Multiple Stored XSS...
Sentrifugo 3.2 - Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Sentrifugo 3.2 - Persistent Cross-Site Scripting Exploit Author: creosote Vendor Homepage: http://www.sentrifugo.com/ Version: 3.2 Tested on: Ubuntu 18.04 CVE : CVE-2019-15814 Multiple Stored XSS vulnerabilities were found in...
