7054 matches found
PT-2018-10232
Name of the Vulnerable Software and Affected Versions Open Whisper Signal aka Signal-Desktop versions prior to 1.10.1 Description The issue allows for XSS via a URL in the js/views/message view.js file. Recommendations For versions prior to 1.10.1, update to version 1.10.1 or later to resolve the...
UBUNTU-CVE-2018-5175
A mechanism to bypass Content Security Policy CSP protections on sites that have a "script-src" policy of "'strict-dynamic'". If a target website contains an HTML injection flaw an attacker could inject a reference to a copy of the "require.js" library that is part of Firefox's Developer Tools, a...
GitLab: Snippet JS template allows attacker to read a user's private snippets
These days snippets can be embedded in a site other than the GitLab instance. An embed link is only generated for public snippets, as can be seen in the app/views/shared/snippets/header.html.haml: haml - if publicsnippet? .embed-snippet .input-group .input-group-btn %button.btn.embed-toggle...
Node.js third-party modules: Remote code executio in NPM package getcookies
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report remote code...
CVE-2018-10188
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/dboperations.js, js/tbloperations.js, libraries/classes/Operations.php, and sql.php...
CVE-2018-10188
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/dboperations.js, js/tbloperations.js, libraries/classes/Operations.php, and sql.php...
CVE-2018-10188
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/dboperations.js, js/tbloperations.js, libraries/classes/Operations.php, and sql.php...
CVE-2018-10188
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/dboperations.js, js/tbloperations.js, libraries/classes/Operations.php, and sql.php...
Joomla JS Jobs 1.2.0 Cross Site Request Forgery
Exploit Title: Joomla! Component Js Jobs - Multiple Cross Site Request Forgery Vulnerabilities Google Dork: N/A Date: 17-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: https://www.joomsky.com Software Link:...
PT-2018-9741
Name of the Vulnerable Software and Affected Versions: phpMyAdmin version 4.8.0 Description: The issue allows an attacker to execute arbitrary SQL statements due to a CSRF problem, related to files such as js/db operations.js, js/tbl operations.js, libraries/classes/Operations.php, and sql.php...
CVE-2018-10188: Cross-Site Request Forgery (CSRF)
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/dboperations.js, js/tbloperations.js, libraries/classes/Operations.php, and sql.php...
CVE-2018-1325
In Apache wicket-jquery-ui = 6.29.0, = 7.10.1, = 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display...
CVE-2018-1325
CVE-2018-1325 affects the Wicket-JQuery-UI integration. In versions ≤ 6.29.0, ≤ 7.10.1, and ≤ 8.0.0-M9.1, JavaScript code created in the WYSIWYG editor can be executed on display, enabling cross-site scripting (XSS) as described in multiple sources. The connected documents corroborate an XSS risk...
CVE-2018-1325
In Apache wicket-jquery-ui = 6.29.0, = 7.10.1, = 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display...
chakra: Crash in Js::JavascriptArray::GetNextIndex
Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=5154384812965888 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fdd5d452000 Crash State: Js::JavascriptArray::GetNextIndex...
Joomla JS Jobs 1.2.0 Component - Cross-Site Request Forgery Vulnerability
Exploit for php platform in category web applications Exploit Title: Joomla! Component Js Jobs - Multiple Cross Site Request Forgery Vulnerabilities Google Dork: N/A Date: 17-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: https://www.joomsky.com...
Joomla! Component JS Jobs 1.2.0 - Cross-Site Request Forgery
Joomla! Component JS Jobs 1.2.0 - Cross-Site Request Forgery Exploit Title: Joomla! Component Js Jobs - Multiple Cross Site Request Forgery Vulnerabilities Google Dork: N/A Date: 17-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage:...
CVE-2018-1325: Improper Neutralization of Input During Web Page Generation
In Apache wicket-jquery-ui = 6.29.0, = 7.10.1, = 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display...
PT-2018-11717
Name of the Vulnerable Software and Affected Versions wicket-jquery-ui versions 6.29.0 and earlier wicket-jquery-ui versions 7.10.1 and earlier wicket-jquery-ui versions 8.0.0-M9.1 and earlier Description The issue allows JS code created in a WYSIWYG editor to be executed on display. This can lea...
Joomla! Component JS Jobs 1.2.0 - Cross-Site Request Forgery
Exploit Title: Joomla! Component Js Jobs - Multiple Cross Site Request Forgery Vulnerabilities Google Dork: N/A Date: 17-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: https://www.joomsky.com Software Link:...