VirtueMart Component Cross-Site Scripting Vulnerability in Joomla!

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, it provides RSS feeds , site search and other features . VirtueMart is one of the e-commerce components . A cross-site scripting vulnerability exists in the assets/js/vm2admin.js file in...

CVE-2018-6834: Improper Neutralization of Input During Web Page Generation

static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...

JS Support Ticket 1.1.0, ,XSS (Cross Site Scripting)

JS Support Ticket 1.1.0, ,XSS Cross Site Scripting UpdateNotice URL 1.1.1 http://www.joomsky.com/products/js-ticket-joomla.html...

CVE-2018-6389 WordPress Parameter Resource Consumption Remote DoS

Yesterday Monday, February 5, 2018, a zero-day vulnerability in WordPress core was disclosed, which allows an attacker to perform a denial of service DoS attack against a vulnerable application. The vulnerability exists in the modules used to load JS and CSS files. These modules were designed to...

CVE-2018-6389

In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service resource consumption by using the large list of registered .js files from wp-includes/script-loader.php to construct a series of requests to load every file many times...

CVE-2018-6389

In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service resource consumption by using the large list of registered .js files from wp-includes/script-loader.php to construct a series of requests to load every file many times...

CVE-2015-3619: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors involving a "double encode combination of firstname, lastname and company."...

Pornhub: Stored XSS (client-side, using cookie poisoning) on the pornhubpremium.com

The researcher discovered that a parameter's value was stored in a cookie and that cookie's value was echoed in certain pages. The researcher was successful in providing an XSS payload as this parameter's value and having it execute. DOM XSS through cookie. Discovered by manual inspection of JS...

chakra: Heap-use-after-free in Js::LiteralStringWithPropertyStringPtr::NewFromCString

Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=4913256519958528 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x61100000a600 Crash State:...

Cross site request forgery (csrf)

CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket...

CVE-2018-6007

CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket...

CVE-2018-6007

CVE-2018-6007 describes a cross‑site request forgery in the Joomla! JS Support Ticket 1.1.0 component. The vulnerability allows an attacker to perform unauthorized actions such as injecting HTML or editing support tickets, via CSRF without explicit user interaction in the documented description. ...

CVE-2018-6007

CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket...

PT-2018-17290

Name of the Vulnerable Software and Affected Versions: Joomla! JS Support Ticket version 1.1.0 Description: A CSRF issue exists in the JS Support Ticket component for Joomla!, allowing attackers to inject HTML or edit a ticket. Recommendations: For Joomla! JS Support Ticket version 1.1.0, update ...

CVE-2018-6007: Cross-Site Request Forgery (CSRF)

CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket...

Joomla JS Support Ticket 1.1.0 Component - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications CODE input type="hidden" name="task" id="task" value="sa...

PT-2018-17396

Name of the Vulnerable Software and Affected Versions Artifex MuJS versions prior to 1.0.3 Description The issue is related to an integer overflow in the js strtod function due to incorrect exponent validation. Recommendations For versions prior to 1.0.3, update to version 1.0.3 or later to resol...

PT-2018-17139

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 4.9.2 Description: The issue concerns a cross-site scripting XSS problem in the Flash fallback files in MediaElement, located under wp-includes/js/mediaelement. Recommendations: For WordPress versions prior to 4.9....

chakra: Crash in Js::SaveTempUncaughtException

Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=5012228790026240 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x55fa8f390750 Crash State: Js::SaveTempUncaughtException...

PT-2018-16849

Name of the Vulnerable Software and Affected Versions Cobham Sea Tel 121 build 222701 Description The issue allows remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the "js/userLogin.js" URI. Default passwords for standard usernam...