6349 matches found
CVE-2017-11617
Cross-site scripting XSS vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of an email via an IMG element with both single quotes and double quotes...
Cross site scripting
Cross-site scripting XSS vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of an email via an IMG element with both single quotes and double quotes...
CVE-2017-11617
Cross-site scripting XSS vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of an email via an IMG element with both single quotes and double quotes...
IDERA Uptime Monitor SQL Injection Vulnerability
IDERA Uptime Monitor is a cross-platform server monitoring software from IDERA. The software provides a server performance, availability and other indicators to collect, summarize and generate reports and other functions. An SQL injection vulnerability exists in the...
WebKit - WebCore::InputType::element Use-After-Free Exploit
Exploit for multiple platform in category dos / poc var runcount = 0; function go runcount++; ifruncount 2 return; i.type = "foo"; i.select; i.type = "search"; document.onsearch = document.body.onload; document.execCommand"insertHTML", false, ""; !--...
WebKit - 'WebCore::InputType::element' Use-After-Free (1)
var runcount = 0; function go runcount++; ifruncount 2 return; i.type = "foo"; i.select; i.type = "search"; document.onsearch = document.body.onload; document.execCommand"insertHTML", false, ""; !-- ================================================================= ASan log:...
Sql injection
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter...
Sql injection
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatifGadget/getxenmetrics.php via the element parameter...
CVE-2017-11470
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatifGadget/getxenmetrics.php via the element parameter...
CVE-2017-11471
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter...
CVE-2017-11471
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter...
CVE-2017-11470
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatifGadget/getxenmetrics.php via the element parameter...
CVE-2017-11471
CVE-2017-11471 affects IDERA Uptime Monitor 7.8. SQL injection vulnerability in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter enables arbitrary SQL execution. CVSS metrics indicate high to critical impact (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitat...
CVE-2017-11471
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter...
Microsoft Internet Explorer 11.0.9600.18617 - CMarkup::DestroySplayTree Memory Corruption
Microsoft Internet Explorer 11.0.9600.18617 - CMarkup::DestroySplayTree Memory Corruption element. The bug was confirmed on IE Version 11.0.9600.18617 Update Version 11.0.40 running on Windows 7 64-bit. I was unable to reproduce it on Windows 10. PoC: ========================================== --...
Microsoft Internet Explorer 11 CMarkup::DestroySplayTree Memory Corruption
Microsoft IE: Memory curruption in CMarkup::DestroySplayTree CVE-2017-8594 There is a memory corruption issue in IE that can be triggered with svg element. The bug was confirmed on IE Version 11.0.9600.18617 Update Version 11.0.40 running on Windows 7 64-bit. I was unable to reproduce it on Windo...
Microsoft Internet Explorer 11.0.9600.18617 - 'CMarkup::DestroySplayTree' Memory Corruption
element. The bug was confirmed on IE Version 11.0.9600.18617 Update Version 11.0.40 running on Windows 7 64-bit. I was unable to reproduce it on Windows 10. PoC: ========================================== -- function go setTimeout"window.location.reload",100;...
Windows Browser Example Exploit
This template covers IE8/9/10, and uses the user-agent HTTP header to detect the browser version. Please note IE8 and newer may emulate an older IE version in compatibility mode, in that case the module won't be able to detect the browser correctly. This is an example Metasploit module to be used...
Cross site scripting
Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can...
