Design/Logic Flaw

HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service invalid read of two bytes and application crash because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh...

Design/Logic Flaw

PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second window and file sizes less than 600 bytes. The effect on SSD devices may be greater...

Design/Logic Flaw

Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

Design/Logic Flaw

Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...

Design/Logic Flaw

securityScan in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file...

Design/Logic Flaw

Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site...

Design/Logic Flaw

Netwide Assembler NASM before 2.13.02 has a use-after-free in detoken at asm/preproc.c...

Design/Logic Flaw

An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\showproduct.html file...

Design/Logic Flaw

An issue has been found in libIEC61850 v1.3. It is a SEGV in EthernetreceivePacket in ethernetbsd.c...

Design/Logic Flaw

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...

Design/Logic Flaw

In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address...

Design/Logic Flaw

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured Intrusion Prevention System IPS rule that inspects certain types of TCP traffic. The vulnerability is due to incorrect TCP retransmission handling. An...

duck-design.com XSS vulnerability

Open Bug Bounty ID: OBB-696237 Description| Value ---|--- Affected Website:| duck-design.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

WordPress Design Flaw Leads to WooCommerce RCE

Impact We detected and reported a file deletion vulnerability in WooCommerce, which was fixed in version 3.4.6. Arbitrary file deletion vulnerabilities arent considered critical in most cases as the only thing an attacker can cause is a Denial of Service by deleting the index.php of the website...

design.fashion.bg XSS vulnerability

Open Bug Bounty ID: OBB-694826 Description| Value ---|--- Affected Website:| design.fashion.bg Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidde...

deborahgraydesign.com XSS vulnerability

Open Bug Bounty ID: OBB-694829 Description| Value ---|--- Affected Website:| deborahgraydesign.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Design/Logic Flaw

An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the pagelist "attached" attribute which typically has 'class="icon-globe icon-large"' in its value, as demonstrated by an 'UPDATE sysmodule SET attached = "XSS" WHERE id="pagelist"' statement...

Design/Logic Flaw

xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...

[SECURITY] Fedora 29 Update: python-django-2.0.9-1.fc29

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Design/Logic Flaw

On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may produce a core file and take the configured HA action...