CVE-2018-6465: Improper Neutralization of Input During Web Page Generation

The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php...

Conceptronic CIPCAMPTIWL Denial of Service Vulnerability

The Conceptronic CIPCAMPTIWL is an IP camera capable of recording audio and video and transmitting it over a network. A denial of service vulnerability exists in Conceptronic CIPCAMPTIWL V3 0.61.30.21. An attacker can cause a denial of service by sending a POST request with a large amount of body...

CVE-2018-6479: Undefined Security Weakness

An issue was discovered on Netwave IP Camera devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to the / URI...

CVE-2018-6407

An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to /hy-cgi/devices.cgi?cmd=searchlandevice. The crash completely freezes the device...

Mail.ru: XSS в теле письма.

XSS via malcrafted HTML "rel" attribute. As a temporary workaround rel attribute was disabled on the day of reporting. A final solution fixes parsing algorithm for rel attributes...

Mozilla: RSS Feed vulnerable to new line Injection

RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird 52.5.2...

CVE-2018-5216

Radiant CMS 1.1.4 has XSS via crafted Markdown input in the partbodycontent parameter to an admin/pages//edit resource...

UBUNTU-CVE-2017-7848

RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird 52.5.2...

CVE-2017-17752

Ability Mail Server 3.3.2 has Cross Site Scripting XSS via the body of an e-mail message, with JavaScript code executed on the Read Mail screen aka the /readmail URI. This is fixed in version 4.2.4...

CVE-2017-14077

HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $SERVER'HTTPUSERAGENT' parameter to exampleform.ajax.php or exampleform.php...

Zeta Components Mail 1.8.1 - Remote Code Execution

Zeta Components Mail 1.8.1 - Remote Code Execution Vendor: Zeta Components module: Mail, returnPath-email”; If attacker assign email address like: '[email protected] -X/var/www/html/cache/exploit.php' and inject payload in mail body, sendmail will transfer log-X into...

You can soon securely unlock smartphone with your “body sweat”

By Carolina As incredulous as it sounds, it is indeed true that This is a post from HackRead.com Read the original post: You can soon securely unlock smartphone with your body sweat...

the-body-shop.it XSS vulnerability

Open Bug Bounty ID: OBB-389071 Description| Value ---|--- Affected Website:| the-body-shop.it Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

Unauthorized Access Vulnerability in Goodbody Knowledge Android APP of Tongfang Co.

Good Body Knowledge Android App is a software to detect the health data in your body. There is an override access vulnerability in the Good Body Knowledge Android APP of Tongfang Co. The attacker registers and logs into the system while grabbing packets and modifying the user ID to query any user...

Arbitrary Account Password Reset Vulnerability in Goodbody Knowledge Android APP of Tongfang Co.

Good Body Knowledge Android App is a software to detect the health data in your body. An arbitrary account password reset vulnerability exists in the Good Body Knowledge Android APP of Tongfang Co. An attacker can reset any account password by grabbing a packet to obtain a verification code throu...

CVE-2017-3935

Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the intended content type...

CVE-2017-3935

CVE-2017-3935 affects McAfee Network Data Loss Prevention (NDLP). All connected sources describe a MIME type sniffing vulnerability where the response body could be interpreted/displayed as a content type different from the intended one, potentially impacting how IE renders the content. The root ...

CVE-2017-3935

Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the intended content type...

The vulnerability of the management tools for virtual infrastructure, such as VMware vCenter Server and VMware ESXi hypervisors, arises from the failure to address sequences of characters CRLF. This allows attackers to control the headers and bodies of HTTP responses, as well as execute cross-site scripting attacks and attacks on intermediate proxy servers.

The vulnerability of the VMware vCenter Server and VMware ESXi hypervisor management infrastructure relates to the lack of measures to neutralize CRLF sequences. User-provided data is appended to HTTP responses without proper processing, allowing arbitrary headers to be inserted into HTTP...

Microsoft Edge Chakra - 'JavascriptFunction::ReparseAsmJsModule' Incorrectly Re-parses

GetParseableFunctionInfo; AssertfunctionInfo; functionInfo-GetFunctionBody-AddDeferParseAttribute; functionInfo-GetFunctionBody-ResetEntryPoint; functionInfo-GetFunctionBody-ResetInParams; FunctionBody funcBody = functionInfo-ParsefunctionRef; if ENABLEPROFILEINFO // This is the first call to the...