CVE-2017-14244

An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FWiB-LR7011A1.0.2 devices potentially allows attackers to directly access administrative router settings by crafting URLs with a .cgi extension, as demonstrated by /info.cgi and /password.cgi...

craft-cv.com XSS vulnerability

Vulnerable URL: http://craft-cv.com/search/%22%3E%3Csvg%20onload%3Dalert%22OPENBUGBOUNTY%22%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 06.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 170860 VIP website status:| No...

Authentication flaw

There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd in LibTIFF 4.0.8, related to tifdirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack...

CVE-2017-13133

In ImageMagick 7.0.6-8, the loadlevel function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service loadtile memory exhaustion via a crafted file...

CVE-2017-7675

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL...

CVE-2017-12144

In ytnef 1.9.2, an allocation failure was found in the function TNEFFillMapi in ytnef.c, which allows attackers to cause a denial of service via a crafted file...

CVE-2017-11639

When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage function in coders/cip.c, related to the GetPixelLuma function in MagickCore/pixel-accessor.h...

UBUNTU-CVE-2017-11573

FontForge 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName parsettf.c resulting in DoS or code execution via a crafted otf file...

Code injection

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar via a crafted web site...

CVE-2017-6742

A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device. The vulnerability is due to a...

CVE-2016-10365

Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domain that redirects to an arbitrary website...

CVE-2016-10365

Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domain that redirects to an arbitrary website...

Craft CMS 2.6 - Cross-Site Scripting/Unrestricted File Upload

Technical Details & Description: ================================ The security risk of the xss vulnerability is estimated as medium with a common vulnerability scoring system count of 3.6. Exploitation of the persistent xss web vulnerability requires a limited editor user account with low...

Craft CMS 2.6 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Craft CMS 2.6 - Cross-Site Scripting/Unrestricted File Upload Date: 2017-06-08 Exploit Author: Ahsan Tahir Vendor Homepage: https://craftcms.com Software Link: http://download.craftcdn.com/craft/2.6/2.6.2981/Craft-2.6.2981.zip...

Craft CMS File Upload Vulnerability

Craft CMS is a content management system CMS. Craft CMS suffers from a file upload vulnerability. A remote attacker can exploit this vulnerability by using a special method to upload files and execute code to write to a shell...

Craft CMS Cross-Site Scripting Vulnerability (CNVD-2017-13599)

Craft CMS is a content management system CMS. Craft CMS suffers from a cross-site scripting vulnerability. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2017-9516

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file...

Cross site scripting

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file...

CVE-2017-9516

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file...

CVE-2017-9516

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file...