CVE-2018-16350: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic formstatcode parameter...

PT-2018-13510

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to a form parameter in a specific PHP file, allowing for XSS attacks. The vulnerable parameter is statcode in the form on the page index.php?m=core&f=set&v=basic. Recommendations For WUZ...

CVE-2018-16231

Michael Roth Software Personal FTP Server PFTP through 8.4f allows remote attackers to cause a denial of service daemon crash via an unspecified sequence of FTP commands...

f-w.co.jp XSS vulnerability

Open Bug Bounty ID: OBB-662546 Description| Value ---|--- Affected Website:| f-w.co.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

f-16.net XSS vulnerability

Open Bug Bounty ID: OBB-661807 Description| Value ---|--- Affected Website:| f-16.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

t-f-a.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-657675 Description| Value ---|--- Affected Website:| t-f-a.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ThreatList: Spam’s Revival is Tied to Adobe Flash’s Demise

Spam click-rates are up in 2018. Last year, 13.4 percent of spam messages that made it into inboxes were clicked on. So far, in 2018 that percentage has jumped to 14.2 percent. The numbers come from F-Secure, which reported Wednesday on the sorry state of users’ better judgment when it comes to...

PT-2018-12559

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A SQL injection issue was found that allows remote attackers to inject malicious SQL statements via the "index.php?m=promote&f=index&v=search keywords" parameter. Recommendations For WUZHI CMS version 4.1.0,...

CVE-2018-14513: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formcontent parameter to the index.php?m=feedback&f=index&v=contact URI...

PT-2018-12557

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A persistent XSS issue was found, allowing remote attackers to inject arbitrary web script or HTML via the formcontent parameter to the "index.php?m=feedback&f=index&v=contact" API endpoint. Recommendations...

CVE-2018-13034: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in Jester web framework 0.2.0 allows remote attackers to fetch files in arbitrary locations via "..%f" sequences...

PT-2018-3995

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 5aba5b89d0b1d73164d3b81764828bb8b20ff32a Description The issue is related to an out of array read in the ASF F format demuxer, which can result in heap memory reading. This can be exploited via a specially crafted ASF...

CVE-2018-13123

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p=rawview for the /etc/passwd file...

CVE-2018-13123: Exposure of Sensitive Information to an Unauthorized Actor

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p=rawview for the /etc/passwd file...

PT-2018-11615

Name of the Vulnerable Software and Affected Versions OneFileCMS versions prior to 2017-10-08 Description The issue allows attackers to read arbitrary files via the i and f parameters. For example, the "/etc/passwd" file can be accessed using the endpoint "?i=etc/&f=passwd&p=raw view"...

F-Secure XFENCE and Little Flocker Command Execution Vulnerabilities

F-Secure XFENCE formerly Little Flocker is a suite of file protection utilities from the Finnish company F-Secure. The program prevents unauthorized access to files and protects against computer security threats such as malware and Trojans. A security vulnerability exists in F-Secure XFENCE and...

MagniComp SysInfo Information Exposure

MagniComp SysInfo Information Exposure CVE-2018-7268 ====================================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/magnicomp-sysinfo-information-exposure.txt Overview -------- MagniComp SysInfo contains a information...

PT-2018-11214

Name of the Vulnerable Software and Affected Versions PHPOK version 4.9.032 Description The issue is related to an arbitrary file deletion vulnerability. It affects the delfile f function located in framework/admin/tpl control.php. Recommendations For PHPOK version 4.9.032, consider restricting...

PT-2018-11213

Name of the Vulnerable Software and Affected Versions PHPOK version 4.9.032 Description The issue is related to an arbitrary file upload vulnerability in the import f function located in framework/admin/modulec control.php. This can be exploited by uploading a .php file within a .php.zip archive...

CVE-2018-10403

An issue was discovered in F-Secure XFENCE and Little Flocker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but t...