D-Link DIR-140L and DIR-640L Information Disclosure Vulnerability

The D-Link DIR-140L and DIR-640L are both wireless router products from AUO D-Link. An information disclosure vulnerability exists in the dirary0.js file in the D-Link DIR-140L version 1.02 and DIR-640L version 1.01RU, which can be exploited by remote attackers to disclose admin credentials...

CVE-2018-18009

dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials...

CVE-2018-18009

dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials...

CVE-2018-18009: Use of Hard-coded Credentials

dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials...

PT-2018-2106

Name of the Vulnerable Software and Affected Versions D-Link DIR-140L and DIR-640L devices Description The issue is related to the storage of credentials in an open manner, allowing remote unauthenticated attackers to discover admin credentials. This can enable a remote attacker to reveal protect...

CVE-2018-1000816

Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting XSS vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where t...

CVE-2018-1000816: Improper Neutralization of Input During Web Page Generation

Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting XSS vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where t...

Stack overflow

There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a denial of service or possibly unspecified other impact via a crafted js file...

CVE-2018-20201

There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a denial of service or possibly unspecified other impact via a crafted js file...

CVE-2018-20201

There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a denial of service or possibly unspecified other impact via a crafted js file...

CVE-2018-20201: Out-of-bounds Read

There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a denial of service or possibly unspecified other impact via a crafted js file...

UBUNTU-CVE-2018-12116

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the path option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to...

PT-2018-2973

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 6.15.0 Node.js versions prior to 8.14.0 Description The issue is related to HTTP request splitting, where Node.js can be tricked into using unsanitized user-provided Unicode data for the path option of an HTTP request...

CVE-2018-19554

An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode, identifier, or fieldName parameter in html/js/dotcms/dijit/image/imagetool.jsp...

PT-2018-14999

Name of the Vulnerable Software and Affected Versions Dotcms versions prior to 5.0.4 Description An issue was discovered that allows attackers to perform XSS attacks. The attack can be performed via the inode, identifier, or fieldName parameter in the "html/js/dotcms/dijit/image/image tool.jsp"...

nodejs: Out of bounds (OOB) write via UCS-2 encoding

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding recognized by Node.js under the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le', Bufferwrite can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last...

CVE-2018-19352

The CVE-2018-19352 issue affects Jupyter Notebook prior to 5.7.2. The root cause is unsafe handling in the tree view, specifically crafted directory names (in notebook/static/tree/js/notebooklist.js) that allow cross‑site scripting. Impact per the sources: a remote attacker can execute JavaScript...

Arbitrary File Inclusion

kibana is vulnerable to arbitrary file inclusion attacks. The vulnerability exists through the Kibana Console API where a request can be sent to include external JS files which could possibly result in executing arbitrary commands...

GHSA-QW96-MM2G-C8M7 Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /error page...

Chaturbate: Passive stored XSS at broadcast room

The hacker found that a specially crafted app names could insert a small amount of data into an A tag's href in the "Broadcaster is running these apps: " chat text. Because of the character limit this required multiple successive clicks on different app names, and in the example utilised the room...