Microsoft SharePoint Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

UBUNTU-CVE-2017-7820

The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects...

Weblate: Content Spoofing

The researcher found that he was able to manipulate the content of the contact form via subject parameter...

Nextcloud Server Content Spoofing Vulnerability (CNVD-2017-05596)

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. A content spoofing vulnerability exists in Nextcloud Server. An attacker could exploit this issue to manipulate and spoof content, which could facilitate further attacks...

Ghost 'Your profile' page HTML injection vulnerability

Ghost is an open source, controlled platform for building and running modern online publishing. Ghost suffers from an HTML injection vulnerability that stems from a failure to adequately validate user input. An attacker could use this vulnerability to execute specially crafted HTML and script cod...

Moodle HTML Injection Vulnerability (CNVD-2017-00905)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. Moodle suffers from an HTML injection vulnerability due to the program failing to...

HTML Injection Vulnerability in Multiple EMC Products

EMC Documentum WebTop is a suite of products that allow users to access Documentum repositories and content management services in a standard browser application.Documentum Administrator is a set of Web-based development tools for performing Documentum system administration tasks. Documentum...

Multiple Critical Remotely Exploitable Flaws Discovered in Memcached Caching System

Hey Webmasters, are you using Memcached to boost the performance of your website? Beware! It might be vulnerable to remote hackers. Three critical Remote Code Execution vulnerabilities have been reported in Memcached by security researcher Aleksandar Nikolich at Cisco Talos Group that expose majo...

Multiple Content Spoofing Vulnerabilities in Open-Xchange AppSuite

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. Open-Xchange AppSuite suffers from multiple content spoofing vulnerabilities that c...

OwnCloud 'files app' content spoofing vulnerability

OwnCloud is a free and open source personal cloud storage solution from German company OwnCloud. The solution offers file management, music storage, calendars and more. A security vulnerability exists in the OwnCloud 'files app' that allows attackers to exploit the vulnerability to manipulate or...

KLA10865 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to bypass security restrictions or inject arbitrary code. Below is a complete list of vulnerabilities 1. An improper values validation at Skia can be exploited remotely via a...

Facebook Messenger Vulnerability Patched

Update Facebook has patched a vulnerability in the desktop and Android mobile versions of its Messenger app that allows an attacker to access and modify chats. Researchers at Check Point Software Technologies privately disclosed the issue May 2 to Facebook, which patched it two weeks later. The...

Sucuri: Manipulating of Sucuri.net (List Subscription) Emails (HTML/Script Injection)

Hi there team! I would like to report a 'sneaky', 'weird', but excisting vulnerability, located at the Sucuri.net domain. “A vulnerability exists within your website allowing un-sanitized email form field inputs which could lead an attacker to pass malicious html&script content masquerading as a...

WordPress Lazyest Gallery Plugin <= 0.10.4.3 - Content Manipulation

This plugin is prone to multiple file/directory insecure permissions local content manipulation. Solution Update the plugin...

vBulletin 2.2.7/2.2.8 HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6337/info Problems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages. vBulletin does not sufficiently filter potentially malicious HTML code from posted messages. A...

phProfession 2.5 upload.php Direct Request Path Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/10190/info Multiple vulnerabilities were reported to exist in phProfession, which is a third-party module for PostNuke. Path disclosure, cross-site scripting and SQL injection vulnerabilities were reported. Exploitation o...

Serendipity 0.x Exit.PHP HTTP Response Splitting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11497/info Serendipity is reported prone to an HTTP response splitting vulnerability. A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This...

Wordpress 1.2 Wp-login.PHP HTTP Response Splitting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11348/info Wordpress is reported prone to a HTTP response splitting vulnerability. The issue presents itself due to a flaw in the affected script that allows an attacker to manipulate how GET requests are handled. A remot...

Admanager 1.1 Content Manipulation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4615/info Admanager is banner advertisement management software. It is written in PHP and will run on most Unix and Linux variants, in addition to Microsoft Windows operating systems. Access to the 'add.php3' script does...

Sympa 4.x New List HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10992/info An HTML injection vulnerability is reported in Sympa. The problem occurs due to a failure of the application to properly sanitize user-supplied input data. Unsuspecting users viewing the affected page will have...