3171 matches found
Cross site request forgery (csrf)
Request is an http client. If a request is made using multipart, and the body type is a number, then the specified number of non-zero memory is passed in the body. This affects Request =2.2.6 2.51.0 =2.67.0...
CVE-2017-16026
Request is an http client. If a request is made using multipart, and the body type is a number, then the specified number of non-zero memory is passed in the body. This affects Request =2.2.6 2.51.0 =2.67.0...
PT-2018-6057
Name of the Vulnerable Software and Affected Versions: Request versions 2.2.6 through 2.46.9 Request versions 2.51.0 through 2.67.0 Description: The issue affects the Request library when a multipart request is made and the body type is a number. In such cases, a buffer of the specified size is...
Denial Of Service (DoS)
github.com/minio/minio is vulnerable to denial of service DoS attacks. The application reads the entire body of a V4 request body into memory during checksum verification, allowing a malicious user to crash the application by sending a V4 request with a large body...
Web Application Penetration Testing Tool: Tracy
Tracy is a pentesting tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner. tracy should be used during the mapping-the-application phase of the pentest to identify sources of input and their corresponding outputs. tracy...
Denial Of Service (DoS)
github.com/minio/minio is vulnerable to denial of service DoS attacks. The application does not limit the request body size, allowing a malicious user to pass a request to the application to consume memory...
WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2018-08585)
WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in the content management feature of WUZHI CMS version 4.1.0. A remote attacker can exploit this vulnerability to injec...
Mautic cross-site scripting vulnerability (CNVD-2018-08601)
Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A cross-site scripting vulnerability exists in versions of Mautic prior to 2.13.0. A remote attacker can exploit this vulnerability to inject arbitrary...
Open-Xchange: [XSS] select/onchange in TinyMCE via set body
Hi. TinyMCE allow insert . For set this content need special link: mailto:aaa?body=. Steps: 1. Go to compose mail 2. Insert URL: mailto:aaa?body=%3Cselect%20onchange%3D%22alertdocument.cookie%22%3E%3Coption%3E2%3C%2Foption%3E%3Coption%3E2%3C%2Foption%3E%3C%2Fselect%3E 3. Save Mail 4. Open this ma...
Information Disclosure
github.com/ory/fosite is vulnerable to information disclosure. The vulnerability exists as the request body may contain client secrets to be exposed when POST-body based client authentication is enabled...
CVE-2018-8777
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service memory consumption...
CVE-2018-1000125
inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTDecoder.decode that can result in a JWT that is decoded and thus implicitly validated even if it lacks a valid signature. This attack...
Huawei Honor Body Fat Scale App Information Disclosure Vulnerability
The Huawei Honor Body Fat Scale app is the official mobile software that accompanies a smart electronic scale from Huawei. The Huawei Honor Body Fat Scale app suffers from an information leakage vulnerability, which is due to the program's failure to strictly restrict access to resources for...
calculator.net XSS vulnerability
Open Bug Bounty ID: OBB-572916 Description| Value ---|--- Affected Website:| calculator.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
body-holic.com XSS vulnerability
Open Bug Bounty ID: OBB-563213 Description| Value ---|--- Affected Website:| body-holic.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-6189: Improper Neutralization of Input During Web Page Generation
F-Secure Radar on-premises before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request body in an outbound request for the /api/latest/vulnerabilityscans/tags/batch resource, aka a "suggested metadata tags for assets" issue...
DRUPAL-CONTRIB-2018-008
This module enables you to show referenced entities in tabs. The module doesn't sufficiently sanitize the body fields of the referenced entities when it prints them to the tabs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create/edit content o...
NETWAVE IP Camera Denial of Service Vulnerability
Netwave IP Camera devices is a network camera. A security vulnerability exists in Netwave IP Camera devices. An attacker can exploit this vulnerability to cause a denial of service crash by sending a POST request with a large body to the root path...