343 matches found
CVE-2013-4318
File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory...
Design/Logic Flaw
File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory...
CVE-2013-4318
CVE-2013-4318 affects the Ruby Gems Features package (Ruby Features 0.3.0). The issue is a file handling flaw where input submitted to /tmp/out.html is not properly validated, enabling a local cross-site scripting (XSS) attack. Some sources describe the risk as a local XSS, while others reference...
CVE-2013-4318
File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory...
Scripteen Image Upload Shell Upload
Exploit Title : Scripteen İmage Upload Script Arbitrary File Injection + Venedor Home Page : https://scripteen.com/ + Author : z3r0fy + Twitter : z3r0fy + Website : www.bugcontainer.gq + CX Security Link : https://cxsecurity.com/issue/WLB-2019100145 + Description : Due to these codes in the...
cPanel Injection Vulnerability (CNVD-2019-36149)
cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An injection vulnerability exists in versions of cPanel prior to 70.0.23. An attacker can exploit this vulnerability to inject...
Cisco Unified Intelligence Center Remote File Injection Vulnerability
A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a user's browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...
The vulnerability of the analysis mechanism of machine learning models used in antivirus protection software CylancePROTECT allows attackers to introduce malicious files by bypassing the protection mechanisms, by embedding specially crafted code into the malicious files.
The vulnerability of the analysis mechanism for machine learning models used in antivirus protection software CylancePROTECT exists due to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to introduce a malicious file by bypassing the protection...
Amazon Linux 2 : ruby (ALAS-2019-1276)
It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory. CVE-2018-8777 It wa...
CVE-2019-14547
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the...
CVE-2018-20914
In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files SEC-368...
Apple iMessage - DigitalTouch tap Message Processing Out-of-Bounds Read
The digital touch iMessage extension can read out of bounds if a malformed Tap message contains a color array that is shorter than the points array and delta array. The method ETTapMessage initWithArchiveData: checks that the points array is twice as long as the deltas array, but only checks that...
Horde Groupware Webmail <= 5.2.22 RCE Vulnerability - Linux
Horde Groupware Webmail is prone to an authenticated remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...
CVE-2019-1860 Cisco Unified Intelligence Center Remote File Injection Vulnerability
A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a users browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...
Cisco Unified Intelligence Center Remote File Injection Vulnerability
A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a user’s browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...
Cisco Unified Intelligence Center Remote File Injection Vulnerability
Cisco Unified Intelligence Center is the United States Cisco Cisco company's set of Web-based reporting platform. The platform provides reports related to business data and call center data presentation capabilities. A remote file injection vulnerability exists in Cisco Unified Intelligence Cente...
Siemens WinCC and SIMATIC HMI Panels < 11.0.2.1 Client Side File Injection
Binary data 720007.prm...
Classified Ad Lister 2.0 Arbitrary File Upload
=========================================================================================== Exploit Title: Classified Ad Lister v2.0 - 'uploads' Arbitrary File Upload Dork: N/A Date: 25-03-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.netartmedia.net/adlister Software Link:...
Horde Form File Upload Vulnerability
Horde Groupware Webmail contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. The exploitation requires the Turba subcomponent to be installed. This module was tested on Horde versions 5.2.22 and 5.2.17 running Horde Form subcomponent use...