3339 matches found
Code injection
HexoEditor v1.1.8-beta is affected by: XSS to code execution...
CVE-2019-1010005
HexoEditor v1.1.8-beta is affected by: XSS to code execution...
CVE-2019-1010005
CVE-2019-1010005 affects HexoEditor v1.1.8-beta. The connected sources describe a cross-site scripting vulnerability that can lead to client-side code execution within the HexoEditor web application, arising from a lack of proper validation of client-side data by the web app. Exploitation details...
Flarum Cross-Site Request Forgery Vulnerability
Flarum is an open source forum system. A cross-site request forgery vulnerability exists in Flarum versions prior to 0.1.0-beta.9. The vulnerability stems from a networked system or product that does not adequately validate the origin or authenticity of data, which can be exploited by an attacker...
CVE-2019-13183
Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings...
CVE-2019-13183
Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings...
D-Link DIR-818LW Command Injection Vulnerability (CNVD-2019-17124)
The D-Link DIR-818LW is a wireless router from AUO D-Link of Taiwan, China. A command injection vulnerability exists in HNAP1 SetWanSettings in the D-Link DIR-818LW versions 2.05.B03 through 2.06B01 BETA. The vulnerability stems from a network system or product not properly filtering specific...
D-Link DIR-818LW Command Injection Vulnerability
The D-Link DIR-818LW is a wireless router from AUO D-Link of Taiwan, China. A command injection vulnerability exists in HNAP1 SetWanSettings in the D-Link DIR-818LW versions 2.05.B03 through 2.06B01 BETA. The vulnerability stems from a network system or product not properly filtering specific...
Is 'Sign in with Apple' Marketing Spin or Privacy Magic? Experts Weigh In
Apple’s “Sign in with Apple” feature promises to protect user privacy – and while many are looking at that claim as more of a marketing move than anything else, authentication experts say it has the potential to have an enormous impact on the data privacy ecosystem. The giant from Cupertino took...
Access control bypass in Apache ZooKeeper
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...
UBUNTU-CVE-2019-0201
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...
PT-2019-5356 · Apache +3 · Apache Zookeeper +3
Name of the Vulnerable Software and Affected Versions: Apache ZooKeeper versions 1.0.0 through 3.4.13 Apache ZooKeeper versions 3.5.0-alpha through 3.5.4-beta Description: The issue is related to ZooKeeper’s getACL command, which does not check any permission when retrieving the ACLs of the...
CVE-2018-12270
In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the client, which may trick users into visiting unintended web sites...
CVE-2018-12270
Affected product: Valve Steam (1528829181 BETA). The vulnerability is a homograph/homoglyph attack that allows creating fake URLs in the Steam client, potentially fooling users into visiting unintended websites. Root cause details are not provided in the documents. Impact is described as user con...
Immunity Canvas: BLUEKEEP
Name| BLUEKEEP ---|--- CVE| CVE-2019-0708 Exploit Pack| CANVAS Description| BLUEKEEP - Remote command execution RDP Notes| CVE Name: CVE-2019-0708 VENDOR: Microsoft NOTES: -- IMPORTANT -- The module is currently in beta stage. If you do not select "Allow remote code execution" from the module's...
grafana: Cross-site Scripting (XSS) in dashboard links
Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links...
CVE-2019-11084
GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies...
CVE-2019-11084
CVE-2019-11084 concerns GAuth 0.9.9 beta, with a stored XSS vulnerability that causes a popup to appear repeatedly and discloses cookies. The available connected sources identify the issue as a stored cross-site scripting flaw affecting GAuth 0.9.9 beta, but do not provide further product version...
