17-Year-Old Weakness in Firefox Let HTML File Steal Other Files From Device

Except for phishing and scams, downloading an HTML attachment and opening it locally on your browser was never considered as a severe threat until a security researcher today demonstrated a technique that could allow attackers to steal files stored on a victim's computer. Barak Tawily, an...

Cross site scripting

A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be use...

PT-2019-11398

Name of the Vulnerable Software and Affected Versions: Pydio versions through 8.2.2 Description: A stored XSS issue exists in the web application, leveraging the file upload and file preview features. An authenticated attacker can upload an HTML file with JavaScript code, and then use a file...

Design/Logic Flaw

An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the applicatio...

CVE-2017-11560

An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the applicatio...

CVE-2017-11560

An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the applicatio...

CVE-2017-11560

CVE-2017-11560 affects ZOHO ManageEngine OpManager 12.2. An authenticated user can upload an HTML file via a Google Map integration, which is then rendered in multiple locations and can execute JavaScript in the application. This creates a potential cross-site scripting path through the uploaded ...

CVE-2017-11560: Improper Neutralization of Input During Web Page Generation

An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the applicatio...

PT-2019-7895

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager version 12.2 Description An issue allows an authenticated user to upload an HTML file by adding a Google Map to the application. This uploaded HTML file is rendered in various application locations, and any included...

CVE-2018-18913

Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location...

Advanced Host Monitor 11.92 beta - Local Buffer Overflow Exploit

Exploit for windows platform in category local exploits !/usr/bin/env python ------------------------------------------------------------------------------------------------------------------------------------ Exploit: Advanced Host Monitor 11.92 beta - Local Buffer Overflow EggHunter Date:...

Feng Office 3.7.0.5 - Remote Command Execution Exploit

Exploit for php platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class MetasploitModule 'Feng Office 3.7.0.5 - Unauthenticated Remote Command...

PT-2019-5550

Name of the Vulnerable Software and Affected Versions Adobe Acrobat and Reader versions 2019.010.20069 and earlier Adobe Acrobat and Reader versions 2017.011.30113 and earlier Adobe Acrobat and Reader versions 2015.006.30464 and earlier Description The issue is related to a type confusion...

PT-2019-5552

Name of the Vulnerable Software and Affected Versions Adobe Acrobat and Reader versions 2019.010.20069 and earlier Adobe Acrobat and Reader versions 2017.011.30113 and earlier Adobe Acrobat and Reader versions 2015.006.30464 and earlier Description The issue is related to a type confusion...

PT-2019-5551

Name of the Vulnerable Software and Affected Versions Adobe Acrobat and Reader versions 2019.010.20069 and earlier Adobe Acrobat and Reader versions 2017.011.30113 and earlier Adobe Acrobat and Reader versions 2015.006.30464 and earlier Description The issue is related to a type confusion...

GetSimple CMS HTML File Execution Vulnerability

Cagintranet GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A security vulnerability exists in Cagintranet GetSimple CMS version 3.3.15. An attacker ca...

GetSimple CMS HTML File Execution Vulnerability (CNVD-2019-00329)

Cagintranet GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A security vulnerability exists in Cagintranet GetSimple CMS version 3.3.15. An attacker ca...

CVE-2018-19420

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension e.g., the test or test.asdf filename, because of admin/upload-uploadify.php, and validatesafefile in...

CVE-2017-7908: Heap-based Buffer Overflow

A heap-based buffer overflow exists in the third-party product Gigasoft, v5 and prior, included in GE Communicator 3.15 and prior. A malicious HTML file that loads the ActiveX controls can trigger the vulnerability via unchecked function calls...

PT-2018-1689

Name of the Vulnerable Software and Affected Versions Adobe Acrobat and Reader versions 2018.011.20063 and earlier Adobe Acrobat and Reader versions 2017.011.30102 and earlier Adobe Acrobat and Reader versions 2015.006.30452 and earlier Description The issue is related to a use-after-free...