CVE-2020-9757

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...

CVE-2020-9757

Craft CMS SEOmatic component before 3.3.0 is vulnerable to Server-Side Template Injection that can lead to remote code execution via malformed data submitted to the metacontainers controller. The CVE-2020-9757 entry is corroborated by multiple connected documents (Nuclei template, Red Hat advisor...

CVE-2020-9757

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...

CVE-2020-9757: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...

Design/Logic Flaw

Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a crafted HTML page...

CVE-2020-7936

An open redirect on the login form and possibly other places in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site...

Huawei EulerOS: Security Advisory for python-pillow (EulerOS-SA-2019-2437)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for binutils (EulerOS-SA-2018-1283)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-20352

In Netwide Assembler NASM 2.15rc0, a heap-based buffer over-read occurs via a crafted .asm file in settextfree when called from expandonesmacro in asm/preproc.c...

CVE-2019-9554

In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI...

CVE-2019-9554

In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI...

Code injection

In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI...

CVE-2019-9554

Craft CMS 3.1.12 Pro contains a Cross-site Scripting (XSS) vulnerability in the header insertion field used when adding source code at the s/admin/entries/news/new URI. The issue is triggered by input in the header insertion field and is described as a stored XSS, potentially allowing an attacker...

CVE-2019-9554

In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI...

CVE-2019-9554: Improper Neutralization of Input During Web Page Generation

In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI...

phpMyAdmin 4.7.7 < 4.9.2 SQLi (PMASA-2019-5)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is at least 4.7.7 and prior to 4.9.2. It is, therefore, affected by a SQL injection SQLi vulnerability. A remote attacker can exploit this by using a crafted database or table name in the...

slpjs input validation error vulnerability

slpjs is a JavaScript library for validating and building the Simple Ledger Protocol SLP. An input validation error vulnerability exists in versions of slpjs prior to 0.21.4, which can be exploited by attackers to create specially crafted bitcoin scripts...

CVE-2019-5100

An exploitable integer overflow vulnerability exists in the BMP header parsing functionality of LEADTOOLS 20. A specially crafted BMP image file can cause an integer overflow, potentially resulting in code execution. An attacker can specially craft a BMP image to trigger this vulnerability...

CVE-2017-5331

Integer overflow in the checkoffset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service process crash and execute arbitrary code via a crafted executable...

Craft CMS Rate Limiting / Brute Force

Exploit Title : Craft CMS up to 3.1.7 Password Prompt Form Lockout weak authentication Author Discovered By : Mohammed Abdul Raheem Author's Company Name : TrekShield IT Solution Private Limited Author Exploit-db : https://www.exploit-db.com/?author=9783 Found Vulnerability On : 16-01-2019 Vendor...