1572 matches found
Threat Analysis Unit (TAU) Threat Intelligence Notification: OSX.Yort
In March of 2019 Kaspersky published an article about the Lazarus APT group continued targeting of financial entities. Their report noted that this new campaign being tracked was targeting both Windows and macOS users. The campaign used both malicious PowerShell scripts on windows as well as macO...
CVE-2019-14467
The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album, because the file extension is not checked...
CVE-2019-16119
SQL injection in the photo-gallery 10Web Photo Gallery plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php albumid parameter...
A week in security (April 1 – 7)
Last week, Malwarebytes Labs took readers on a brief tour of some of the world's most notable data privacy laws, explored how gamers can protect themselves against cyberthreats, and offered thoughts about the reports that a 23-year-old Chinese woman gained access to President Donald Trump’s...
CVE-2019-8362
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/albumedit.php or dede/albumadd.php, as demonstrated by a dede/albumedit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" because input validation only checks that .jpg, .png, or .gif is prese...
CVE-2019-8362
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/albumedit.php or dede/albumadd.php, as demonstrated by a dede/albumedit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" because input validation only checks that .jpg, .png, or .gif is prese...
mistresslola.net XSS vulnerability
Open Bug Bounty ID: OBB-671946 Description| Value ---|--- Affected Website:| mistresslola.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
ASUSTOR ADM SQL Injection Vulnerability
ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. photo gallery is one of the photo management applications. An SQL injection vulnerability exists in the 'albumid' and 'scope' parameters of the tree list function of the photo gallery application in ASUSTOR...
CVE-2018-11511
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'albumid' or 'scope' parameter via a photo-gallery/api/album/treelists/ URI...
CVE-2018-11511: Improper Neutralization of Special Elements used in an SQL Command
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'albumid' or 'scope' parameter via a photo-gallery/api/album/treelists/ URI...
QCMS Cross-Site Scripting Vulnerability (CNVD-2019-10280)
QCMS is an open source content management system CMS for creating responsive websites. A cross-site scripting vulnerability exists in upload/System/Controller/backend/album.php in QCMS 3.0.1, which can be exploited by remote attackers to inject arbitrary web script or HTML...
CVE-2018-14975
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS...
Pornhub: Stored XSS in galleries - https://www.redtube.com/gallery/[id] path
Researcher successfully closed the image 'alt' attribute and injected javascript by intercepting the album creation request and submitting an XSS payload as the album title. This led to stored cross-site scripting on the user's album page, executed against any users who visited the album. Stored...
Trovebox SQL Injection Vulnerability
Trovebox is an open source image sharing and management platform. album is one of the album components. A SQL injection vulnerability exists in the album component in Trovebox versions prior to 4.0.0-rc6. A remote attacker can exploit this vulnerability by sending an HTTP request to view, add,...
Trovebox PHP Authentication Bypass Vulnerability
Trovebox is an open source image sharing and management platform. album view is one of the album view component. An authentication bypass vulnerability exists in the album view component in Trovebox 4.0.0-rc6 and earlier versions. An attacker can exploit this vulnerability by sending an HTTP...
CVE-2018-1000551
Trovebox version = 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Authentication bypass. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 742b8edbe...
CVE-2018-1000551
Trovebox version = 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Authentication bypass. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 742b8edbe...
CVE-2018-1000551: Undefined Security Weakness
Trovebox version = 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Authentication bypass. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 742b8edbe...
CVE-2018-1000552: Improper Neutralization of Special Elements used in an SQL Command
Trovebox version = 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed...
