43 matches found
CVE-2021-23558
The CVE-2021-23558 entry affects the JavaScript library bmoor prior to 0.10.1, where the set function allows Prototype Pollution due to missing input sanitization. The vulnerability is linked to an incomplete fix referenced by CVE-2020-7736. Practical impact is Prototype Pollution risk in objects...
bmoor-cache (>=0.3.0, <=0.6.0), bmoor-comm (>=0.0.1, <=0.6.0) +7 more potentially affected by CVE-2020-7736 +1 more via bmoor (>=0.0.5, <=0.9.8)
bmoor NPM version =0.0.5, =0.3.0, =0.0.1, =0.5.0, =0.2.0, =0.1.0, =0.0.4, =0.6.0, =0.6.43 Source cves: CVE-2020-7736, CVE-2021-23558 Source advisory: SNYK:JS-BMOOR-2342622...
bmoor-cache (>=0.3.0, <=0.6.0), bmoor-comm (>=0.0.1, <=0.6.0) +4 more potentially affected by CVE-2020-7736 via bmoor (>=0.0.5, <=0.5.1)
bmoor NPM version =0.0.5, =0.3.0, =0.0.1, =0.2.0, =0.1.0, =0.0.4, =0.6.0, =0.6.43 Source cves: CVE-2020-7736 Source advisory: OSV:GHSA-H3RX-G5C9-8Q4X...
CVE-2020-7736
creationtimestamp| type| source ---|---|--- 2020-10-02 14:53:56+00:00| seen| https://t.me/cibsecurity/15010 2022-01-29 00:22:22+00:00| seen| https://t.me/cibsecurity/36534...
CVE-2020-7736 Prototype Pollution
The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function...
CVE-2020-7736
The CVE-2020-7736 entry applies to the JavaScript package bmoor . Affected versions are those prior to 0.8.12, with vulnerability described as a Prototype Pollution flaw exposed through the vulnerable function set . The issue arises from unsafe handling that allows pollution of object prototypes,...
bmoor-cache (>=0.3.0, <=0.6.0), bmoor-comm (>=0.0.1, <=0.6.0) +4 more potentially affected by CVE-2020-7736 via bmoor (>=0.0.5, <=0.5.1)
bmoor NPM version =0.0.5, =0.3.0, =0.0.1, =0.2.0, =0.1.0, =0.0.4, =0.6.0, =0.6.43 Source cves: CVE-2020-7736 Source advisory: SNYK:JS-BMOOR-598664...
CVE-2019-7736
D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101...
CVE-2019-7736
D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101...
CVE-2019-7736
CVE-2019-13101 affects D-Link DIR-600M devices (firmware 3.02/3.03/3.04/3.06). WAN.htm can be accessed without authentication, allowing information disclosure about the WAN and enabling an attacker to modify data fields on the page. Connected docs corroborate an authentication bypass with direct ...
Z-Blog 1.5.1.1740 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Z-Blog 1.5.1.1740 XSS Vulnerability Exploit Author: zzw email protected Vendor Homepage: https://www.zblogcn.com/ Software Link: https://github.com/zblogcn/zblogphp Version: 1.5.1.1740 CVE : CVE-2018-7736 This is a XSS...
Z-Blog 1.5.1.1740 - Cross-Site Scripting
Z-Blog 1.5.1.1740 - Cross-Site Scripting Exploit Title: Z-Blog 1.5.1.1740 XSS Vulnerability Date: 2018-04-03 Exploit Author: zzw [email protected] Vendor Homepage: https://www.zblogcn.com/ Software Link: https://github.com/zblogcn/zblogphp Version: 1.5.1.1740 CVE : CVE-2018-7736 This is a XSS...
Z-Blog 1.5.1.1740 Cross Site Scripting
Exploit Title: Z-Blog 1.5.1.1740 XSS Vulnerability Date: 2018-04-03 Exploit Author: zzw [email protected] Vendor Homepage: https://www.zblogcn.com/ Software Link: https://github.com/zblogcn/zblogphp Version: 1.5.1.1740 CVE : CVE-2018-7736 This is a XSS vulnerability than can attack the users. poc:...
Z-Blog 1.5.1.1740 - Cross-Site Scripting
Exploit Title: Z-Blog 1.5.1.1740 XSS Vulnerability Date: 2018-04-03 Exploit Author: zzw [email protected] Vendor Homepage: https://www.zblogcn.com/ Software Link: https://github.com/zblogcn/zblogphp Version: 1.5.1.1740 CVE : CVE-2018-7736 This is a XSS vulnerability than can attack the users. poc:...
CVE-2018-7736
In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZCBLOGSUBNAME parameter or ZCUPLOADFILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability...
CVE-2018-7736
Z-BlogPHP 1.5.1.1740 has an XSS issue in cmd.php exploitable via ZC_BLOG_SUBNAME or ZC_UPLOAD_FILETYPE (observed payloads demonstrate client-side script injection). The CVE entry notes the maintainer disputes this as a vulnerability. Connected sources (Exploit-DB, 1337DAY, PacketStorm) describe w...
CVE-2017-7736
A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...
CVE-2017-7736
The CVE-2017-7736 entry applies to Fortinet FortiWeb: a stored Cross-site Scripting (XSS) vulnerability on the webUI Certificate View page affecting FortiWeb versions 5.8.0, 5.7.1 and earlier. The root cause is a flaw that lets an attacker inject arbitrary web script or HTML via a specially craft...
CVE-2017-7736
A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...