DRUPAL-CONTRIB-2018-027

This module adds a new formatter for the file fields, which allows any file extension to be uploaded. The module doesn't sufficiently handle sanitization under the scenario uploaded SVG files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create...

VulnCheck KEV: CVE-2018-10831

Z-NOMP before 2018-04-05 has an incorrect Equihash solution verifier that allows attackers to spoof mining shares, as demonstrated by providing a solution with x1=1,x2=1,x3=1,...,x512=1 to bypass this verifier for any blockheader. This originally affected for example the Bitcoin Gold and Zcash...

perpustakaan.undiksha.ac.id XSS vulnerability

Open Bug Bounty ID: OBB-607581 Description| Value ---|--- Affected Website:| perpustakaan.undiksha.ac.id Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Elastic Stack 6.2.4 and 5.6.9 security update

X-Pack Machine Learning XSS vulnerability ESA-2018-06 X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting XSS vulnerability. Users with manageml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to...

rocking-all-life-long.com XSS vulnerability

Open Bug Bounty ID: OBB-601738 Description| Value ---|--- Affected Website:| rocking-all-life-long.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-0362: Cross-Site Request Forgery (CSRF)

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token...

all-inkl.com XSS vulnerability

Open Bug Bounty ID: OBB-598825 Description| Value ---|--- Affected Website:| all-inkl.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

festool.be XSS vulnerability

Open Bug Bounty ID: OBB-597994 Description| Value ---|--- Affected Website:| festool.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Twonky Server Directory Traversal Vulnerability

Twonky Server is the industry-leading DLNA/UPnP media server from Lynx Technology that enables the sharing of media content between connected devices. A directory traversal vulnerability exists in Twonky Server. A remote attacker could use the contentbase parameter of rpc/setall in the ... double...

Twonky Server Cross-Site Scripting Vulnerability

Twonky Server is the industry-leading DLNA/UPnP media server from Lynx Technology that enables the sharing of media content between connected devices. A cross-site scripting vulnerability exists in Twonky Server. A remote attacker can exploit this vulnerability to inject arbitrary web script or...

CVE-2018-7171

Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. dot dot in the contentbase parameter to rpc/setall...

CVE-2018-7203

Cross-site scripting XSS vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/setall...

All Aliases Have Failed

Challenge A Tenant's Backup Job or Backup Copy Job targeting a Cloud Repository fails with the following message: Target gate has rejected connection. Unable to establish target connection. All aliases have failed. The wording of the error might differ, but the root error "All Aliases Have Failed...

Yii 'findByCondition' Function SQL Injection Vulnerability

Yii is the Yii team developed a set of component-based , high-performance PHP framework for developing large-scale Web applications . A SQL injection vulnerability exists in the 'findByCondition' function in the framework/db/ActiveRecord.php file in version 2.x of Yii before 2.0.15. A remote...

CVE-2017-14006

GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded credentials. Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices...

shop.obkladypasek.cz XSS vulnerability

Open Bug Bounty ID: OBB-582520 Description| Value ---|--- Affected Website:| shop.obkladypasek.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-6623

An issue was discovered in Hola 1.79.859. An unprivileged user could modify or overwrite the executable with arbitrary code, which would be executed the next time the service is started. Depending on the user that the service runs as, this could result in privilege escalation. The issue exists...

CVE-2018-0547

Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0546

Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors...