CVE-2018-6007

CVE-2018-6007 describes a cross‑site request forgery in the Joomla! JS Support Ticket 1.1.0 component. The vulnerability allows an attacker to perform unauthorized actions such as injecting HTML or editing support tickets, via CSRF without explicit user interaction in the documented description. ...

CVE-2018-6007: Cross-Site Request Forgery (CSRF)

CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket...

PT-2018-17290

Name of the Vulnerable Software and Affected Versions: Joomla! JS Support Ticket version 1.1.0 Description: A CSRF issue exists in the JS Support Ticket component for Joomla!, allowing attackers to inject HTML or edit a ticket. Recommendations: For Joomla! JS Support Ticket version 1.1.0, update ...

Joomla JS Support Ticket 1.1.0 Component - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications CODE input type="hidden" name="task" id="task" value="sa...

PT-2018-17396

Name of the Vulnerable Software and Affected Versions Artifex MuJS versions prior to 1.0.3 Description The issue is related to an integer overflow in the js strtod function due to incorrect exponent validation. Recommendations For versions prior to 1.0.3, update to version 1.0.3 or later to resol...

PT-2018-17139

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 4.9.2 Description: The issue concerns a cross-site scripting XSS problem in the Flash fallback files in MediaElement, located under wp-includes/js/mediaelement. Recommendations: For WordPress versions prior to 4.9....

chakra: Crash in Js::SaveTempUncaughtException

Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=5012228790026240 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x55fa8f390750 Crash State: Js::SaveTempUncaughtException...

PT-2018-16849

Name of the Vulnerable Software and Affected Versions Cobham Sea Tel 121 build 222701 Description The issue allows remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the "js/userLogin.js" URI. Default passwords for standard usernam...

CVE-2018-5266: Exposure of Sensitive Information to an Unauthorized Actor

Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the js/userLogin.js URI. NOTE: default passwords for the standard usernames are listed in the product's documentation: Dealer with...

Design/Logic Flaw

Brave Software's Brave Browser, version 0.19.73 and earlier is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being able to access the fingerprinting-associated browser functionality that the browser intends to block...

CVE-2017-1000461

Brave Software's Brave Browser, version 0.19.73 and earlier is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being able to access the fingerprinting-associated browser functionality that the browser intends to block...

CVE-2017-1000461

Brave Browser (0.19.73 and earlier) is affected by CVE-2017-1000461 due to an incorrect access-control flaw in the JS fingerprinting blocking component. This vulnerability could allow a malicious website to access fingerprinting-related browser functionality that the browser intends to block. The...

CVE-2017-1000461

Brave Software's Brave Browser, version 0.19.73 and earlier is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being able to access the fingerprinting-associated browser functionality that the browser intends to block...

CVE-2017-1000488

The CVE-2017-1000488 entry concerns Mautic 2.1.0–2.11.0, which is vulnerable to inline JavaScript XSS in Mautic forms on a landing page when GET parameters pre-populate the form. Root cause cited across sources is lack of sanitization on GET parameters used for pre-population. Consequences includ...

CVE-2017-1000466

Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code...

CVE-2017-1000488: Improper Neutralization of Input During Web Page Generation

Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form...

CVE-2017-1000461: Incorrect Permission Assignment for Critical Resource

Brave Software's Brave Browser, version 0.19.73 and earlier is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being able to access the fingerprinting-associated browser functionality that the browser intends to block...

PT-2018-5228

Name of the Vulnerable Software and Affected Versions Brave Browser versions 0.19.73 and earlier Description The issue is related to an incorrect access control problem in the "JS fingerprinting blocking" component. This allows a malicious website to access browser functionality that is intended ...

Zomato: [www.zomato.com] Privilege Escalation - /php/restaurant_menus_handler.php

Introduction In the following ██████████ the endpoint /php/restaurantmenushandler.php was found. This endpoint is meant solely to be accessible for admins, however due to insufficient protections normal users can access this endpoint too. This results in any Zomato user being able to edit and...

NoSQL Exploitation Framework 2.0 - A Framework For NoSQL Scanning and Exploitation

A FrameWork For NoSQL Scanning and Exploitation Framework Authored By Francis Alexander. Added Features: First Ever Tool With Added Support For Mongo,Couch,Redis,H-Base,Cassandra Support For NoSQL WebAPPS Added payload list for JS Injection,Web application Enumeration. Scan Support for...