639 matches found
Subrion CMS 4.2.1 - Cross-Site Scripting
Subrion CMS 4.2.1 - Cross-Site Scripting Exploit Title: Subrion CMS- 4.2.1 XSS Using component with known Vulnerability Date: 02-08-2018 Exploit Author: Zeel Chavda Vendor Homepage: https://subrion.org/ Software Link: https://subrion.org/download/ Version: 4.2.1 REQUIRED Tested on: Windows,FireFo...
CVE-2018-14840
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads but does block, for example, .htm file uploads...
U.S. Dept Of Defense: Stored Xss Vulnerability on ████████
Summary: A Xss vulnerability using svg file & html file. Step-by-step Reproduction Instructions 1. Go to https://██████████/SitePages/Register.aspx and register. 2. Go to https://██████████/Profiles/My/Your Username/Blog/default.aspx and click Create a Post button. 3. Click Body textarea and clic...
CVE-2018-3747
The public node module versions = 1.0.3 allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript...
Brave Software: Local files reading using `link[rel="import"]`
Summary: HTML file could import another file using . Brave returns Access-Control-Allow-Origin: response header for local HTML files. That leads to local files reading. This vulnerability makes 369218 critical. Products affected: Brave: 0.23.19 V8: 6.7.288.46 rev:...
CVE-2017-7840
JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resulting exported HTML file is later opened in a browser this JavaScript will be executed. This could be used in social engineering and self-cross-site-scripti...
Cross site scripting
JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resulting exported HTML file is later opened in a browser this JavaScript will be executed. This could be used in social engineering and self-cross-site-scripti...
CVE-2017-7840
JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resulting exported HTML file is later opened in a browser this JavaScript will be executed. This could be used in social engineering and self-cross-site-scripti...
JFrog Artifactory Arbitrary File Upload Vulnerability
JFrog Artifactory is an open source, general-purpose Artifact repository manager from Israel's JFrog that supports clustering and high-availability Docker registries and provides an end-to-end automation solution for tracking artifacts from development to production. An arbitrary file upload...
Unrestricted file upload
Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to 1 deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or 2 possibly write to arbitrary files and cause a denial of service by uploading a...
Magento Downloadable Products Cross Site Scripting
DefenseCode Security Advisory Magento Stored Cross-Site Scripting a Downloadable Products Advisory ID: DC-2018-03-003 Advisory Title: Magento Stored Cross-Site Scripting a Downloadable Products Advisory URL: http://www.defensecode.com/advisories.php Software: Magento Version: Magento 2.0 prior to...
Sql injection
SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the 1 PATHINFO or 2 name of a .html file under the all-offers/ URI...
Adobe Acrobat and Reader Out-of-bounds Read (APSB17-36: CVE-2017-16408)
An out-of-bounds read vulnerability exists in Adobe Acrobat and Reader. The vulnerability is due to computation that reads data that is past the end of the target buffer. A remote attacker could exploit this vulnerability by enticing a user to open a maliciously crafted HTML file...
Cross-site Scripting (XSS)
phpmyfaq is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script by uploading a HTML file to the application...
Microsoft Windows 10 - WLDP/MSHTML CLSID UMCI Bypass Exploit
Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1328 Windows: WLDP/MSHTML CLSID UMCI Bypass Platform: Windows 10 S thought should be anything with UMCI Class: Security Feature Bypass Summary: The enlightened lockdown policy chec...
Microsoft Windows 10 - WLDP/MSHTML CLSID UMCI Bypass
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1328 Windows: WLDP/MSHTML CLSID UMCI Bypass Platform: Windows 10 S thought should be anything with UMCI Class: Security Feature Bypass Summary: The enlightened lockdown policy check for COM Class instantiation can be bypassed in...
Mac OS X Local Javascript Quarantine Bypass youtube Vulnerability
Exploit for macOS platform in category local exploits Details Mac OS X contains a vulnerability that allows the bypass of the Apple Quarantine and the execution of arbitrary Javascript code without restrictions. Basically, Apple's Quarantine works by setting an extended attribute to downloaded...
CVE-2017-12707
A Stack-based Buffer Overflow issue was discovered in SpiderControl SCADA MicroBrowser Versions 1.6.30.144 and prior. Opening a maliciously crafted html file may cause a stack overflow...
Cacti cross-site scripting vulnerability (CNVD-2017-26580)
Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . A cross-site scripting vulnerability exists in the lib/html.php fil...
