11691 matches found
h1-5411-CTF: h1-5411-CTF report: LFI / Deserialization / XXE vulnerability,
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: h1-5411-ctf write-up The CTF...
Google Chrome Arbitrary Code Execution Vulnerability (CNVD-2018-20076)
Google Chrome is a web browser developed by the American company Google Google. An arbitrary code execution vulnerability exists in Catalog Service in Google Chrome versions prior to 64.0.3282.119, which stems from a failure to fully enforce policy, and can be exploited by a remote attacker to ru...
Google Chrome Address Bar Spoofing Vulnerability (CNVD-2018-20745)
Google Chrome is a web browser developed by Google, Inc. and Omnibox is a real-time search engine. A security vulnerability exists in Omnibox in versions of Google Chrome prior to 64.0.3282.119. A remote attacker can exploit this vulnerability to spoof the content of Omnibox URL bar with the help...
MyBB Visual Editor 1.8.18 - Cross-Site Scripting
Title: MyBB Visual Editor 1.8.18 - Cross-Site Scripting Author: Numan OZDEMIR Vendor Homepage: mybb.com Software Link: https://mybb.com/download/ Version: Up to v1.8.18. Fixed in v1.8.19. PoC Video: https://numanozdemir.com/mybb/xss.mp4 CVE: CVE-2018-17128 Description: Attacker can run JavaScript...
Click It Up: Targeting Local Government Payment Portals
FireEye has been tracking a campaign this year targeting web payment portals that involves on-premise installations of Click2Gov. Click2Gov is a web-based, interactive self-service bill-pay software solution developed by Superion. It includes various modules that allow users to pay bills associat...
PoDoFo Information Disclosure Vulnerability
PoDoFo is an open source , written in C++ using the PDF file format library . PoDoFo in the 'PdfEncoding::ParseToUnicode ' function there is an information leakage vulnerability , the vulnerability stems from the program fails to correctly validate the data submitted by the user , an attacker can...
GHSA-FM87-46VV-JQRR Path Traversal in html-pages
Versions of html-pages before 2.1.0 are vulnerable to path traversal. Recommendation Update to version 2.1.0 or later...
Path Traversal in html-pages
Versions of html-pages before 2.1.0 are vulnerable to path traversal. Recommendation Update to version 2.1.0 or later...
The vulnerability of the JavaScript script handler ChakraCore in Microsoft Edge and Internet Explorer allows a perpetrator to execute arbitrary code.
The vulnerability of the JavaScript script handler ChakraCore in Microsoft Edge and Internet Explorer is related to errors in memory object handling. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted web pages, applications, or Microsoft Offi...
Information disclosure
An issue was discovered in DonLinkage 6.6.8. SQL injection in /pages/proxy/php.php and /pages/proxy/add.php can be exploited via specially crafted input, allowing an attacker to obtain information from a database. The vulnerability can only be triggered by an authorized user...
CVE-2018-17092
An issue was discovered in DonLinkage 6.6.8. SQL injection in /pages/proxy/php.php and /pages/proxy/add.php can be exploited via specially crafted input, allowing an attacker to obtain information from a database. The vulnerability can only be triggered by an authorized user...
CVE-2018-17061
BullGuard Safe Browsing before 18.1.355.9 allows XSS on Google, Bing, and Yahoo! pages via domains indexed in search results...
Microsoft Internet Explorer MSCTF CInputContextAdapter Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Feindura Cross-Site Scripting Vulnerability
feindura is a set of open source CMS Content Management System written in PHP. A cross-site scripting vulnerability exists in the index.php?category=0&page=new page in feindura version 2.0.7, which can be exploited by a remote attacker to execute malicious script in the browser with the help of t...
CVE-2018-15310
A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages...
yellowpages.co.th XSS vulnerability
Open Bug Bounty ID: OBB-675791 Description| Value ---|--- Affected Website:| yellowpages.co.th Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidde...
Microsoft Internet Explorer Security Bypass Vulnerability (CNVD-2018-24940)
Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation in the U.S. Internet Explorer IE is a Web browser that comes with the Windows operating system. A security feature bypass vulnerability exists in Microsoft IE version 11. A remote attacker with a...
CVE-2018-16772
Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new...
