Mautic cross-site scripting vulnerability (CNVD-2018-08601)

Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A cross-site scripting vulnerability exists in versions of Mautic prior to 2.13.0. A remote attacker can exploit this vulnerability to inject arbitrary...

Open-Xchange: [XSS] select/onchange in TinyMCE via set body

Hi. TinyMCE allow insert . For set this content need special link: mailto:aaa?body=. Steps: 1. Go to compose mail 2. Insert URL: mailto:aaa?body=%3Cselect%20onchange%3D%22alertdocument.cookie%22%3E%3Coption%3E2%3C%2Foption%3E%3Coption%3E2%3C%2Foption%3E%3C%2Fselect%3E 3. Save Mail 4. Open this ma...

Information Disclosure

github.com/ory/fosite is vulnerable to information disclosure. The vulnerability exists as the request body may contain client secrets to be exposed when POST-body based client authentication is enabled...

CVE-2018-8777

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service memory consumption...

CVE-2018-1000125

inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTDecoder.decode that can result in a JWT that is decoded and thus implicitly validated even if it lacks a valid signature. This attack...

Huawei Honor Body Fat Scale App Information Disclosure Vulnerability

The Huawei Honor Body Fat Scale app is the official mobile software that accompanies a smart electronic scale from Huawei. The Huawei Honor Body Fat Scale app suffers from an information leakage vulnerability, which is due to the program's failure to strictly restrict access to resources for...

calculator.net XSS vulnerability

Open Bug Bounty ID: OBB-572916 Description| Value ---|--- Affected Website:| calculator.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

body-holic.com XSS vulnerability

Open Bug Bounty ID: OBB-563213 Description| Value ---|--- Affected Website:| body-holic.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-6189: Improper Neutralization of Input During Web Page Generation

F-Secure Radar on-premises before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request body in an outbound request for the /api/latest/vulnerabilityscans/tags/batch resource, aka a "suggested metadata tags for assets" issue...

DRUPAL-CONTRIB-2018-008

This module enables you to show referenced entities in tabs. The module doesn't sufficiently sanitize the body fields of the referenced entities when it prints them to the tabs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create/edit content o...

PT-2018-19476

This module enables you to show referenced entities in tabs. The module doesn't sufficiently sanitize the body fields of the referenced entities when it prints them to the tabs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create/edit content o...

NETWAVE IP Camera Denial of Service Vulnerability

Netwave IP Camera devices is a network camera. A security vulnerability exists in Netwave IP Camera devices. An attacker can exploit this vulnerability to cause a denial of service crash by sending a POST request with a large body to the root path...

Hardcoded credentials

The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php...

CVE-2018-6465

The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php...

CVE-2018-6465

The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php...

CVE-2018-6479: Undefined Security Weakness

An issue was discovered on Netwave IP Camera devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to the / URI...

CVE-2018-6465: Improper Neutralization of Input During Web Page Generation

The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php...

PT-2018-17562

Name of the Vulnerable Software and Affected Versions PropertyHive plugin versions prior to 1.4.15 Description The issue allows for XSS via the body parameter to the "includes/admin/views/html-preview-applicant-matches-email.php" endpoint. Recommendations For versions prior to 1.4.15, update to...

Conceptronic CIPCAMPTIWL Denial of Service Vulnerability

The Conceptronic CIPCAMPTIWL is an IP camera capable of recording audio and video and transmitting it over a network. A denial of service vulnerability exists in Conceptronic CIPCAMPTIWL V3 0.61.30.21. An attacker can cause a denial of service by sending a POST request with a large amount of body...

CVE-2018-6407

An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to /hy-cgi/devices.cgi?cmd=searchlandevice. The crash completely freezes the device...