3901 matches found
TP-Link TL-R600VPN HTTP Server Denial of Service Vulnerability
The TP-Link TL-R600VPN is an enterprise router from China P&L TP-LINK. the HTTP Server is one of the HTTP servers. A denial of service vulnerability exists in the HTTP Server in TP-Link TL-R600VPN HWv3 FRNv1.3.0 version and HWv2 FRNv1.2.3 version. An attacker can exploit the vulnerability with th...
Cross-Site Scripting (XSS)
validator is vulnerable to cross-site scripting. A remote attacker is able to bypass the Javascript filter via a crafted URL to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...
Cross-Site Scripting (XSS)
DotNetNuke.Core is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser via a crafted URL containing text that is used within a modal popup...
WordPress 3.9.x < 3.9.22 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...
F5 Networks BIG-IP : Reflected XSS vulnerability in an undisclosed Configuration utility page (K41704442)
A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15315 Impact BIG-IP A remote unauthenticated attacker could potentially exploit...
F5 Networks BIG-IP : XSS vulnerability in undisclosed TMUI page (K04524282)
A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15314 Impact BIG-IP A remote unauthenticated attacker could potentially exploit...
Drupal cross-site scripting vulnerability (CNVD-2018-21851)
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the search autofill feature in Drupal version 7.x. The vulnerability stems from the program improperly validating...
GHSA-X5X7-3V85-WPC4 Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this...
CVE-2018-1744
IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 148423...
Ubuntu 14.04 LTS / 16.04 LTS : Tomcat vulnerability (USN-3787-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3787-1 advisory. It was discovered that Tomcat incorrectly handled returning redirects to a directory. A remote attacker could possibly use this issue with a specially...
USN-3787-1 tomcat7, tomcat8 vulnerability
It was discovered that Tomcat incorrectly handled returning redirects to a directory. A remote attacker could possibly use this issue with a specially crafted URL to redirect to arbitrary URIs...
Responsive Filemanager Cross-Site Scripting Vulnerability
Responsive FileManager is an open source file manager written in PHP that supports uploading and managing videos, images and other files. A cross-site scripting vulnerability exists in Responsive Filemanager version 9.8.1, which can be exploited by a remote attacker to execute script in a victim'...
Responsive Filemanager 9.8.1 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications I. VULNERABILITY ------------------------- Responsive Filemanager 9.8.1 Reflected Cross Site Scripting XSS II. CVE REFERENCE ------------------------- CVE-2018-18062 III. VENDOR ------------------------- https://www.responsivefilemanager.com I...
Responsive Filemanager 9.8.1 Cross Site Scripting
I. VULNERABILITY ------------------------- Responsive Filemanager 9.8.1 Reflected Cross Site Scripting XSS II. CVE REFERENCE ------------------------- CVE-2018-18062 III. VENDOR ------------------------- https://www.responsivefilemanager.com IV. REFERENCES -------------------------...
CVE-2018-1649
IBM QRadar Incident Forensics 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 144655...
Design/Logic Flaw
IBM QRadar Incident Forensics 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 144655...
CVE-2018-14826
Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with a specially crafted URL. This could allow for remote code execution...
Cross-Site Scripting (XSS)
dojo is vulnerable to cross-site scripting. User input is not sanitized in the server response before being displayed on a user's browser. An attacker is able to inject arbitrary Javascript into a victim's browser through a crafted URL via the status parameter...
Fixed in Apache Tomcat 8.5.34
Moderate: Open Redirect CVE-2018-11784 When the default servlet returned a redirect to a directory e.g. redirecting to /foo/ when the user requested /foo a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. This was fixed in revision...