CVE-2018-5286

The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page...

Security Bulletin: NVIDIA SHIELD TV Security Updates for CPU Speculative Side Channel Vulnerabilities

NVIDIA SHIELD TV Response to CPU Speculative Side Channel Vulnerabilities - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 Bulletin Summary NVIDIA is providing an initial security update to mitigate aspects of Google Project Zero's January 3, 2018, publication of novel information disclosure attacks...

Tizen Studio 1.3 Smart Development Bridge Buffer Overflow

Exploit Title: Smart Development Bridge =2.3.2 part of Tizen Studio 1.3 Windows x86/x64 - Buffer Overflow PoC Date: 22.10.17 Exploit Author: Marcin Kopec Vendor Homepage: https://developer.tizen.org/ Software Link: https://developer.tizen.org/development/tizen-studio/download Version: 2.3.0, 2.3....

allaboutjazz.com XSS vulnerability

Vulnerable URL:...

UBUNTU-CVE-2017-7816

WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security checks that disallow this behavior. This vulnerability affects Firefox 56...

Stored Cross-Site Scripting Vulnerability in the YoYo Housing App

YouYouGoodHouse app is a rental app created by Chengdu GoodHouse Technology Co. A stored cross-site scripting vulnerability exists in the "About Us" section of the YouYouHaoRooms app. An attacker can insert malicious js code into the page to obtain user cookies and other information, resulting in...

agroit.eu XSS vulnerability

Vulnerable URL: https://www.agroit.eu/SitePages/About.aspx?FollowSite=0=%27-confirm%27OPENBUGBOUNTY%27-%27 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 21.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 9886051 VIP website status...

SQL Injection Vulnerability in about.php Page of HopYoung Website Builder System

The Hop-Up Network Building System is a website building system. A SQL injection vulnerability exists in the about.php page of the HopYoung website builder system, which can be exploited by attackers to obtain sensitive information from the database...

SQL injection vulnerability in the class2id parameter of the about.php page of the website building system of Kunming Senyu Technology Co.

Kunming Senyu Technology Co., Ltd. is a website building system. There is a SQL injection vulnerability in the class2id parameter on the about.php page of Kunming Senyu Technology Co. Attackers can use this vulnerability to obtain sensitive database information...

SQL Injection and Cross-site Scripting Vulnerabilities in Yitianlian's Enterprise Website Builder

Shenzhen Yitianlian Technology Co., Ltd. is a network operator providing online marketing services for enterprises. SQL injection and cross-site scripting vulnerabilities exist in the about.php and list.php parameters of the Yitianlian website builder system, which can be exploited by an attacker...

news.allaboutjazz.com XSS vulnerability

Vulnerable URL: https://news.allaboutjazz.com/faq.php?=1"...

psi.or.tz XSS vulnerability

Vulnerable URL: http://psi.or.tz/about-psi/tend.php?tend=1"...

ClipBucket Cross-Site Scripting Vulnerability (CNVD-2017-05016)

ClipBucket is an open source video sharing software. The software allows you to share videos to video sites and supports the light off effect when watching a movie. A cross-site scripting vulnerability exists in ClipBucket version 2.8.1. A remote attacker can exploit this vulnerability by injecti...

ZZCMS V8.0 SQL Injection Vulnerability in admin/about.php File

ZZCMS is an enterprise website builder. A SQL injection vulnerability exists in the ZZCMS V8.0 admin/about.php file. The lack of filtering of the 'id' parameter obtained from $post'id' allows an attacker to exploit the vulnerability to obtain sensitive database information...

Wordpress Theagency Themes File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress Themes Theagency File Upload Vulnerability Author : Berandal Google Dork: inurl:/wp-content/themes/theagency Tested on: Win 7, Linux Blog : http://www.maxteroit.com/ Video Proof :...

Design/Logic Flaw

XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter...

UBUNTU-CVE-2017-5391

Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a content-injection bug were found in one of those pages this could allow for potential privilege escalation. This vulnerability affects Firefox 51...

Security vulnerabilities fixed in Firefox 51 — Mozilla

JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. Use-after-free while manipulating XSL in XSLT documents A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potential...

Microsoft Edge Remote Elevation of Privilege Vulnerability

Microsoft Edge is the web browser built into the Windows 10 version. Microsoft Edge has an elevation of privilege vulnerability in the about:blank page cross-domain policy implementation that allows an attacker to access information in one domain and insert it into other domains. An attacker who...

Mozilla: Data from Pocket server improperly sanitized before execution (MFSA 2016-94, MFSA 2016-95)

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...