PT-2018-16167 · Node.Js · Atob

Name of the Vulnerable Software and Affected Versions: atob versions 2.0.3 and earlier Description: The issue arises when the atob function allocates uninitialized Buffers upon receiving a number as input on Node.js versions 4.x and below. Recommendations: Update to version 2.1.0 or later...

Path Traversal

Overview Versions of html-pages before 2.1.0 are vulnerable to path traversal. Recommendation Update to version 2.1.0 or later. References - HackerOne Report - GitHub Advisory...

Doorkeeper is vulnerable to stored XSS and code execution

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting XSS vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be...

GHSA-HWHH-2FWM-CFGW Doorkeeper is vulnerable to stored XSS and code execution

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting XSS vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be...

CVE-2018-5977

SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&pricetype=range&price= request...

Affiligator 2.1.0 - SQL Injection

Affiligator 2.1.0 - SQL Injection Exploit Title: Affiligator - Affiliate Webshop Management System 2.1.0 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: https://www.getaffiligator.com/ Software Link: https://codecanyon.net/item/affiligator-affiliate-webshop-management-system/21214946...

Mautic Load Page Cross-Site Scripting Vulnerability

Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A cross-site scripting vulnerability exists in the Mautic loading page in Mautic versions 2.1.0 through 2.11.0. A remote attacker can exploit the...

Next Gen Editor,2.1.0,SQL Injection

Next Gen Editor, 2.1.0, SQL Injection and multiple other vulnerabilities resolution: update to version 2.2.0 update notice: http://nextgeneditor.com/index.php/en/support/forum/installation-issues/3957-new-security-release...

CVE-2017-6679

The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel SSH which auto initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for...

Unspecified Vulnerability in Ipsilon

Ipsilon is a server and toolkit for configuring Apache-based service providers to provide federated authentication SSO to web applications with pluggable standalone modwsgi applications. An unspecified vulnerability exists in versions of Ipsilon prior to 2.1.0. No detailed vulnerability details a...

Cisco Umbrella Virtual Appliance 2.0.3 Undocumented Support Tunnel Vulnerability

Cisco Umbrella Virtual Appliance versions 2.0.3 and below contain an undocumented, auto-initiated reverse SSH tunnel which allows the Cisco Umbrella support team to have persistent and unrestricted access to the virtual appliance. Cisco Umbrella Virtual Appliance - Undocumented Support Tunnel...

Denial of service

A vulnerability in the web console of the Cisco Cloud Services Platform CSP 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines VMs operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation o...

Command injection

An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS command injection vulnerability has been identified that may allow the execution of arbitrary code on the system through the inclusion of OS commands in the URL...

Eclipse Kura Command Execution Vulnerability

Eclipse Kura is an OSGi-based M2M service gateway application framework from the Eclipse Foundation. A security vulnerability exists in versions of Eclipse Kura prior to 2.1.0. An attacker could exploit the vulnerability to log in to the device, execute commands, or take control of the device...

WordPress Easy Modal Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . Easy Modal plugin is one of the pop-up window plugin . A SQL injection vulnerability exists in the...

Information disclosure

Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters...

Code injection

FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo input value...

CVE-2017-11167

FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo input value...

CVE-2017-11167

CVE-2017-11167 affects FineCMS 2.1.0. The vulnerability allows remote attackers to execute arbitrary PHP code by abusing the URL Manager’s “Add Site” action: entering code after a ', sequence in a domain name, demonstrated with ',phpinfo()'. Connected CNVD/CNVD-2017-15550 and NVD entries corrobor...

Juniper Networks NorthStar Controller Application Denial of Service Vulnerability

Juniper Networks NorthStar Controller Application is a traffic planning controller from Juniper Networks, Inc. The controller optimizes service provider transport networks by establishing open industry standard protocols. A denial of service vulnerability exists in Juniper Networks NorthStar...