CVE-2017-1002101

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type including non-privileged pods, subject to file permissions can access files/directories outside of the volume, including the host's filesyste...

CVE-2017-1002102

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running...

PYSEC-2018-46

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOKAUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your...

CVE-2018-1000046

NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remote code execution. This attack appear to be exploitable via Victim opening a specially crafted radar data file. This vulnerability appears to have been fixed in v1.4...

Cross site request forgery (csrf)

Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a potential reflected cross-site scripting...

CVE-2017-1000389

CVE-2017-1000389 affects Jenkins global-build-stats plugin (v1.4 and earlier). The vulnerability arises from JSON responses served with Content-Type: text/html, allowing potential reflected XSS, and from some data-modifying URLs that did not require POST, enabling potential CSRF. The connected so...

Cross site scripting

An exploitable cross site scripting XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an...

CVE-2017-12097

An exploitable cross site scripting XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an...

CVE-2017-12097

An exploitable cross site scripting XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an...

CVE-2017-12097

CVE-2017-12097 affects the delayed_job_web rail gem, where the filter functionality is vulnerable to cross-site scripting. A specially crafted URL can cause arbitrary JavaScript execution in the victim’s browser, enabling an attacker to phish an authenticated user. Affected versions include 1.2.9...

Vanguard Marketplace Digital Products PHP Arbitrary File Upload Vulnerability

Vanguard Marketplace Digital Products PHP is a set of PHP-based scripts for online trading sites for MP3 and other digital files. A security vulnerability exists in Vanguard Marketplace Digital Products PHP version 1.4. The vulnerability can be exploited to upload arbitrary files via the Add New...

GraphicsMagick 'ReadMNGImage' function buffer overflow vulnerability

GraphicsMagick is a simple set of image processing tools. The tool provides resizing, rotating, highlighting and other functions to images. A buffer overflow vulnerability exists in the 'ReadMNGImage' function in the coders/png.c file in GraphicsMagick version 1.4 snapshot-20171217 Q8. A remote...

CVE-2017-17874

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

CVE-2017-17915

In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadMNGImage in coders/png.c, related to accessing one byte before testing whether a limit has been reached...

Vanguard 1.4 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Vanguard - Marketplace Digital Products PHP 1.4 - SQL Injection Dork: N/A Date: 11.12.2017 Vendor Homepage: https://www.codegrape.com/user/Vanguard/portfolio Software Link:...

Vanguard 1.4 - Arbitrary File Upload

Exploit Title: Vanguard - Marketplace Digital Products PHP 1.4 - Arbitrary File Upload Dork: N/A Date: 11.12.2017 Vendor Homepage: https://www.codegrape.com/user/Vanguard/portfolio Software Link: https://www.codegrape.com/item/vanguard-marketplace-digital-products-php/15825 Demo:...

Vanguard 1.4 - Arbitrary File Upload

Vanguard 1.4 - Arbitrary File Upload Exploit Title: Vanguard - Marketplace Digital Products PHP 1.4 - Arbitrary File Upload Dork: N/A Date: 11.12.2017 Vendor Homepage: https://www.codegrape.com/user/Vanguard/portfolio Software Link:...

Vanguard 1.4 - SQL Injection

Exploit Title: Vanguard - Marketplace Digital Products PHP 1.4 - SQL Injection Dork: N/A Date: 11.12.2017 Vendor Homepage: https://www.codegrape.com/user/Vanguard/portfolio Software Link: https://www.codegrape.com/item/vanguard-marketplace-digital-products-php/15825 Version: 1.4 Category: Webapps...

Pivotal Single Sign-On for PCF Cross-Site Scripting Vulnerability

Pivotal Single Sign-On for PCF is a suite of single sign-on security access tools for PCFs from Pivotal Software, USA. A security vulnerability exists in Pivotal Single Sign-On for PCF versions 1.3.x prior to 1.3.4 and 1.4.x prior to 1.4.3. An attacker can exploit the vulnerability by injecting...

Integer overflow vulnerability in libxls 'xls_preparseWorkSheet' function (CNVD-2017-37688)

libxls is a C library for reading Exce xls files. An integer overflow vulnerability exists in the 'xlspreparseWorkSheet' function in libxls version 1.4. A remote attacker can exploit this vulnerability to execute code memory corruption with the help of a malicious XLS file...