CVE-2017-1000419

phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application...

GitLab: GitHub import allows user to create child group under existing namespace

When importing a GitHub repository on GitLab, a request is made to /import/github. The user is allowed to pass along a target namespace where they want to add the repository. In this process, the code will create the namespace if it doesn't exist already. However, this can be used to create a...

HOT Man Android App Has Information Leakage Vulnerability

HOT Man Android APP is a mobile magazine software. There is an information leakage vulnerability in HOT Man Android APP. After registering and logging in to the system, an attacker can obtain sensitive information such as other users' UIDs, names, and cell phone numbers by clicking on "My Avatar"...

b3log Symphony Cross-Site Scripting Vulnerability

b3log Symphony aka Sym is an open source set of modern community platforms written in the Java language, including forums, BBS, SNS and blogs. A cross-site scripting vulnerability exists in b3log Symphony version 2.2.0. A remote attacker can exploit this vulnerability by sending a specially craft...

CVE-2017-16881

b3log Symphony aka Sym 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted userAvatarURL value to /settings/avatar, related to processor/AdminProcessor.java, processor/ArticleProcessor.java, processor/UserProcessor.java, service/ArticleQueryService.java,...

Mail.ru: blind XXE when uploading avatar in mymail phone app

Blind XML external ENTITY / DTD injection via avatar upload feature in My.Com's MyMail backend results in potential SSRF...

CVE-2017-15284

Cross-Site Scripting exists in OctoberCMS 1.0.425 aka Build 425, allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account...

OctoberCMS Cross-Site Scripting Vulnerability

OctoberCMS is a CMS system based on Laravel PHP development framework. A cross-site scripting vulnerability exists in OctoberCMS, which allows an attacker to upload an SVG file containing malicious code as an "avatar" of a configuration file. When opened by an administrator, this file can cause...

Mail.ru: Blind XXE on my.mail.ru

Blind XXE in my.mail.ru Moi Mir avatar upload feature. Moi Mir is not covered by regular Bug Bounty program, a bounty was awarded as a bones due to high potential impact. Blind OOB XXE issue was found in upload avatar feature...

Stable Channel Updates for Chrome OS

The Stable channel has been updated to 61.0.3163.113 Platform version: 9765.76.0 for most Chrome OS devices . This build contains a number of bug fixes, security updates, and feature enhancements. Systems will be receiving updates over the next several days. Some highlights of these changes are:...

TeamWork Job Links profileChange and coverChange arbitrary file upload vulnerability (CNVD-2017-33670)

TeamWork Photo Fusion is a web-based photo management system that allows users to upload photos or view other users' photos. changeAvatar and changeCover are both functional modules. changeAvatar is a module for changing a user's avatar. changeCover is a module for changing a cover. changeAvatar ...

WordPress: Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE.

Description This report is very similar to https://hackerone.com/bugs?subject=user&reportid=203515 so I will not go into too much details. When uploading a avatar or profile background image thats larger than allowd, the error containing the filename will be output unsanitized leading to XSS...

phpBB 3.2.0 Server Side Request Forgery

phpBB version 3.2.0 suffers from a server-side request forgery vulnerability. ======================================================================= title: Server Side Request Forgery Vulnerability product: phpBB vulnerable version: 3.2.0 fixed version: 3.2.1 CVE number: impact: Medium homepage:...

phpBB 3.2.0 Server Side Request Forgery

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Server Side Request Forgery Vulnerability product: phpBB vulnerable version: 3.2.0 fixed version: 3.2.1 CVE number: impact: Medium homepage: https://www.phpbb.com/ found:...

Code execution vulnerability in javapms

JAVAPMS is a JAVA Portal Management System JAVA Portal Management System for short, SpringMVC + Spring + Hibernate + Freemarker + Html5 + jQuery for the technical core architecture, for the majority of webmasters, software developers, program enthusiasts, web page designers, for individual...

File Upload Vulnerability in Ctrip CMS (XerCMS) at Member Avatar Upload

Ctrip CMS XerCMS is a content management system based on php+mysql, integrating membership, community, guestbook, news and model management. XerCMS has a file upload vulnerability at the member avatar upload. Since the program uses a blacklist filtering mechanism for the filename suffix of the...

Cross-site scripting vulnerability in FineCMS latest version 2.1.5

FineCMS is a content management system based on PHP+MySql. The latest version of FineCMS version 2.1.5 has a cross-site scripting vulnerability, the vulnerability stems from the front-end avatar uploads are not sufficiently filtered user-submitted inputs, an attacker can exploit the vulnerability...

CVE-2017-8778

GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document...

CVE-2017-8778

GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a 1 comment frame or 2 avatar frame...