9511 matches found
CVE-2018-10591
In Advantech WebAccess versions V8.220170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an origin validation error vulnerability has been identified, which may...
WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2018-09387)
WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in WUZHI CMS version 4.1.0. A remote attacker can exploit this vulnerability by sending the 'tag' parameter to the...
CVE-2018-5176
The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. Thi...
CVE-2018-9112
A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges b...
CVE-2018-9112
A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges b...
USN-3643-1 wget vulnerability
It was discovered that Wget incorrectly handled certain inputs. An attacker could possibly use this to inject arbitrary cookie values...
GNU wget - Cookie Injection Vulnerability
Exploit for linux platform in category local exploits GNU Wget Cookie Injection CVE-2018-0494 ========================================= The latest version of this advisory is available at: https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt Overview -------- GNU Wget is susceptible to a...
Stored Cross-Site Scripting Vulnerability in YzmCMS v3.8
YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A stored cross-site scripting vulnerability exists in YzmCMS v3.8. Attackers can insert malicious js code in the page to obtain user...
GNU wget - Cookie Injection
GNU wget - Cookie Injection GNU Wget Cookie Injection CVE-2018-0494 ========================================= The latest version of this advisory is available at: https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt Overview -------- GNU Wget is susceptible to a malicious web server...
GNU wget - Cookie Injection
GNU Wget Cookie Injection CVE-2018-0494 ========================================= The latest version of this advisory is available at: https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt Overview -------- GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to th...
Stored Cross-Site Scripting Vulnerability at Order Invoice in Cloud EC E-commerce System
Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system order invoice at the existence of stored cross-site scripting vulnerabilities. An...
XSS Payload List - Cross Site Scripting Vulnerability Payload List
Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user...
Facebook Introduces “Clear History” Option Amid Data Scandal
Facebook unveiled new updates to its social-media platform this week aimed at securing private data – including a new privacy control called “Clear History.” CEO Mark Zuckerberg outlined the new data privacy measure in a post. Clear History essentially brings the capabilities that users are...
Node.js third-party modules: Remote code executio in NPM package getcookies
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report remote code...
Design/Logic Flaw
On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload LRO and SYN cookies are enabled default settings, undisclosed traffic patterns may cause TMM to restart...
CVE-2018-5512
On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload LRO and SYN cookies are enabled default settings, undisclosed traffic patterns may cause TMM to restart...
CVE-2018-5512
On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload LRO and SYN cookies are enabled default settings, undisclosed traffic patterns may cause TMM to restart...
CVE-2018-5512
On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload LRO and SYN cookies are enabled default settings, undisclosed traffic patterns may cause TMM to restart...
Denial of Service Vulnerability in Multiple F5 Products (CNVD-2018-10114)
F5 BIG-IP LTM, etc. are products of F5 Corporation, U.S.A. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager. A security vulnerability exists in several F5 products. When Large Receive Offload and SYN cookies are turned on, an attacker can exploit the...
Denial of Service Vulnerability in Multiple F5 Products (CNVD-2018-10113)
F5 BIG-IP LTM, etc. are products of F5 Corporation, U.S.A. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager. A security vulnerability exists in several F5 products. When Large Receive Offload and SYN cookies are turned on, an attacker can exploit the...