PT-2018-16461

Name of the Vulnerable Software and Affected Versions iOS versions prior to 11.3.1 macOS versions prior to 10.13.4 Security Update 2018-001 Description The issue involves the LinkPresentation component and allows remote attackers to spoof the UI via a crafted URL in a text message. Recommendation...

Metview Parameter Injection Vulnerability

Metview is an open source weather analysis application. The program is capable of acquiring data from multiple sources and performing meteorological analysis. A security vulnerability exists in Metview version 4.7.3 in etc/ObjectList, which originates from the program failing to validate strings...

Cisco Prime Collaboration Provisioning SQL Injection Vulnerability (CNVD-2018-11254)

Cisco Prime Collaboration Provisioning PCP is a set of Web-based, next-generation communications services software from Cisco. The software provides IP communication service features for IP telephony, voice mail and unified communications environments. A SQL injection vulnerability exists in the...

yzt directory traversal vulnerability

yzt is a simple file server. Yzt suffers from a directory traversal vulnerability. An attacker can exploit this vulnerability by placing "... /" in a URL to access the file system...

CVE-2018-1000181

Kitura 2.3.0 and earlier have an unintended read access to unauthorised files and folders that can be exploited by a crafted URL resulting in information disclosure...

PT-2018-9350

Name of the Vulnerable Software and Affected Versions Kitura versions 2.3.0 and earlier Description The issue allows for unintended read access to unauthorized files and folders. This can be exploited by a crafted URL, resulting in information disclosure. Recommendations For versions 2.3.0 and...

CVE-2018-1000181: Exposure of Sensitive Information to an Unauthorized Actor

Kitura 2.3.0 and earlier have an unintended read access to unauthorised files and folders that can be exploited by a crafted URL resulting in information disclosure...

EMS Master Calendar < 8.0.0.20180520 - Cross-Site Scripting

Exploit Title: EMS Master Calendar alert'XSS'xyz...

CVE-2018-11628

Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS...

Cross site scripting

Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS...

CVE-2018-11633

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...

CVE-2018-11632

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings via...

Cross site request forgery (csrf)

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...

CVE-2018-0271

A vulnerability in the API gateway of the Cisco Digital Network Architecture DNA Center could allow an unauthenticated, remote attacker to bypass authentication and access critical services. The vulnerability is due to a failure to normalize URLs prior to servicing requests. An attacker could...

CVE-2018-10241

A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application with a NULL pointer dereference via a specially crafted URL beginning with the /Web%20Client/ substring...

Null pointer dereference

A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application with a NULL pointer dereference via a specially crafted URL beginning with the /Web%20Client/ substring...

CVE-2017-18266

The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment...

UBUNTU-CVE-2018-10992

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU...

CVE-2018-10992

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU...

Design/Logic Flaw

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU...