PT-2018-10964

Name of the Vulnerable Software and Affected Versions Roxy Fileman versions prior to 1.4.6 Description The issue allows for directory traversal via the "f" parameter in the php/download.php endpoint. Recommendations For Roxy Fileman versions prior to 1.4.6, update to version 1.4.6 or later to...

CVE-2018-11493: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m=link&f=index&v=add...

Microsoft Windows Kernel 'Win32k.sys' Local Privilege Escalation Vulnerability(CVE-2018-8120)

作者：bigric3 作者博客： 5月15日ESET发文其在3月份捕获了一个 pdf远程代码执行（cve-2018-4990）+windows本地权限提升（cve-2018-8120）的样本。ESET发文后，我从vt上下载了这样一份样本（）。初步逆向，大致明确如外界所传，该漏洞处于开发测试阶段，不慎被上传到了公网样本检测的网上，由ESET捕获并提交微软和adobe修补。测试特征字符串如下 定位样本中关键的代码并调试分析...

WUZHI CMS 4.1.0 - tag[pinyin] Cross-Site Scripting

WUZHI CMS 4.1.0 - tagpinyin Cross-Site Scripting Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability Date: 2018-4-23 Exploit Author: jiguang [email protected] Vendor Homepage: https://github.com/wuzhicms/wuzhicms Software Link: https://github.com/wuzhicms/wuzhicms Version: 4.1.0 CVE: CVE-2018-10311 An...

GNU Wget 1.19.4 Cookie Injection

GNU Wget Cookie Injection CVE-2018-0494 ========================================= The latest version of this advisory is available at: https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt Overview -------- GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to th...

GNU wget - Cookie Injection

GNU wget - Cookie Injection GNU Wget Cookie Injection CVE-2018-0494 ========================================= The latest version of this advisory is available at: https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt Overview -------- GNU Wget is susceptible to a malicious web server...

Denial of Service Vulnerability in Multiple F5 Products (CNVD-2018-10114)

F5 BIG-IP LTM, etc. are products of F5 Corporation, U.S.A. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager. A security vulnerability exists in several F5 products. When Large Receive Offload and SYN cookies are turned on, an attacker can exploit the...

Denial of Service Vulnerability in Multiple F5 Products (CNVD-2018-10113)

F5 BIG-IP LTM, etc. are products of F5 Corporation, U.S.A. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager. A security vulnerability exists in several F5 products. When Large Receive Offload and SYN cookies are turned on, an attacker can exploit the...

Cross site scripting

A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tagpinyin parameter to the /index.php?m=tags&f=index&v=add URI...

CVE-2018-10311

A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tagpinyin parameter to the /index.php?m=tags&f=index&v=add URI...

CVE-2018-10313: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq10%5D parameter to the /index.php?m=member&f=index&v=profile&setiframe=1 URI...

PT-2019-13820

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.16.4 Description A double-locking error in the Linux kernel may potentially cause a deadlock. The issue is related to the f hid function in drivers/usb/dwc3/gadget.c. Recommendations For versions prior to 4.16....

CVE-2018-10248: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycledelete...

CVE-2018-9926: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add...

PT-2018-19094

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue was found that allows adding an admin account via the "index.php?m=core&f=power&v=add" endpoint. Recommendations For WUZHI CMS version 4.1.0, update to a newer version that contains a fix for th...

CVE-2018-9927: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a user account via index.php?m=member&f=index&v=add...

PT-2018-19095

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue was discovered, allowing an attacker to add a user account via the "index.php?m=member&f=index&v=add" endpoint. Recommendations For WUZHI CMS version 4.1.0, consider implementing proper CSRF...

f-facts.nl XSS vulnerability

Open Bug Bounty ID: OBB-597193 Description| Value ---|--- Affected Website:| f-facts.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

f-f.ir XSS vulnerability

Open Bug Bounty ID: OBB-594194 Description| Value ---|--- Affected Website:| f-f.ir Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PT-2018-3589 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.16.4 Description: A double free vulnerability in the f midi set alt function of drivers/usb/gadget/function/f midi.c in the f midi driver may allow attackers to cause a denial of service or possibly have...