Google Chrome Omnibox URL Spoofing Vulnerability (CNVD-2018-24374)

Google Chrome is a web browser developed by Google, Inc. and Omnibox is a real-time search engine. A security vulnerability exists in Omnibox in iOS-based versions of Google Chrome prior to 70.0.3538.67, which stems from the program's failure to properly handle browsing history. A remote attacker...

Google Chrome V8 Memory Misreference Vulnerability

Google Chrome is the United States Google Google company developed a Web browser. v8 is one of the open source JavaScript engine. A memory misreference vulnerability exists in V8 in versions of Google Chrome prior to 70.0.3538.67. A remote attacker can exploit this vulnerability to damage objects...

Google Chrome Unauthorized Access Vulnerability

Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in Google Chrome versions prior to 70.0.3538.67. A remote attacker can exploit the vulnerability to gain unauthorized access to the system with the help of specially crafted HTML pages...

GHSA-PJFR-QF3P-3Q25 When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled e.g. via setting the readonly initialisation parameter of the Default to false it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it containe...

Foxit Reader and Foxit PhantomPDF for Windows Memory Misreference Vulnerability (CNVD-2018-25201)

Foxit Reader for Windows is a Windows-based PDF document reader from China's Foxit Foxit Software Corporation.Foxit PhantomPDF for Windows is its commercial version. A memory misreference vulnerability exists in the handling of the display attribute of the button in Foxit Reader 9.2.0.9297 and...

CentOS 7 : tomcat (CESA-2018:2921)

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Important: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Next.js Cross-Site Scripting Vulnerability

Next.js is a lightweight framework for static applications. A cross-site scripting vulnerability exists in Next.js versions 7.0.0 and 7.0.1 on 404 or 500 /error pages, which can be exploited by a remote attacker to execute client-side code on these pages by sending a specially crafted request...

ASUS RT-AC58U Cross-Site Scripting Vulnerability

ASUS RT-AC58U is a wireless router product from ASUS. A cross-site scripting vulnerability exists in ASUS RT-AC58U version 3.0.0.4.3806516. The vulnerability can be exploited to inject arbitrary web script or HTML via multiple files AdvancedASUSDDNSContent.asp, AdvancedWSecurityContent.asp,...

S-CMS Hospital Website Builder System has SQL Injection Vulnerability in Frontend

S-CMS hospital station building system is developed by asp+access/mssql, easy to operate, convenient, support PC+mobile+WeChat. There is a SQL injection vulnerability in the frontend of S-CMS Hospital Building System. An attacker can exploit the vulnerability to obtain sensitive information from...

Shopify: H1514 Extract information about other sites (new sites) through Affiliate/Referral pages

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: This bug is based on a really...

SQL Injection Vulnerability in Hongting Financial CRM Customer Management Software

Hongting Financial CRM Customer Management Software is a sales management platform that provides the most advanced and comprehensive sales management solution for business users. A SQL injection vulnerability exists in Hanting Financial CRM Customer Management Software, which can be exploited by...

CVE-2018-12596

Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden normally available exclusively for local...

CVE-2018-12596

CVE-2018-12596 affects Episerver/Ektron CMS (notably version 9.20 SP2) where remote attackers can reach the activateuser.aspx page, even when located under /WorkArea/ (normally restricted to local admins). The vulnerability is caused by improper access restrictions, permitting unauthorized enabli...

CVE-2018-12596

Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden normally available exclusively for local...

Ektron CMS 9.20 SP2 - Improper Access Restrictions Vulnerability

Exploit for asp platform in category web applications Details ================ Software: Ektron Content Management System CMS Version: 9.20 SP2 Homepage: https://www.episerver.com Advisory report: https://github.com/alt3kx/CVE-2018-12596 CVE: CVE-2018-12596 CVSS: 7.5 HIGH:...

PT-2018-13871 · Telerik · Telerik Extensions For Asp.Net Mvc

Name of the Vulnerable Software and Affected Versions: Telerik Extensions for ASP.NET MVC all versions Description: The issue allows a remote attacker to access files inside the server's web directory because it does not properly restrict access to these files. This product has been obsolete sinc...

Foxit Reader for Windows Memory Misreference Vulnerability (CNVD-2018-20653)

Foxit Reader for Windows is China's Foxit Foxit Software Corporation, a Windows-based platform for PDF document reader. A memory misreference vulnerability exists in the handling of the Format event in Foxit Reader 9.2.0.9297 and earlier versions for Windows platforms, where the program fails to...

CVE-2018-15563

core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter...

CVE-2018-17830

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...