CVE-2017-5965

The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which a .asp file has a ..\ in its pathname, visiting sitecore/shell/applications/install/dialogs/Upload%20Package/UploadPackage2.aspx to upload...

Apache jUDDI Open Redirect Vulnerability

Apache jUDDI is the United States Apache Apache Software Foundation of a Java-based , open source follow the UDDI standard application . An open redirection vulnerability exists in Apache jUDDI. An attacker can exploit this vulnerability to redirect the browser to an arbitrary Web page...

Concrete CMS: Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0)

Intro First things first, so... Crayons, crayons everywhere : Type of issue: Core CMS issue Level of severity: Internal Attack Vector Concrete5 version: 8.1.0 Summary There is Stored XSS vulnerability in Name field SEO dialog for pages. Malicious user is able to prepare payload which is then...

Unauthorized Access Vulnerability in HP Officejet Pro X451dw Printer

The HP Officejet Pro X451dw is a desktop printer from HP. An unauthorized access vulnerability exists in the HP Officejet Pro X451dw Printer, which can be exploited by an attacker to gain unauthorized access to configuration pages and obtain sensitive information...

NextCloud / OwnCloud Cross Site Scripting

================================================================== Nextcloud/Owncloud - Reflected Cross Site Scripting in error pages ================================================================== Information ------------------------------------------------------------------ Name:...

CVE-2017-0241

An elevation of privilege vulnerability exists when Microsoft Edge renders a domain-less page in the URL, which could allow Microsoft Edge to perform actions in the context of the Intranet Zone and access functionality that is not typically available to the browser when browsing in the context of...

Information Leakage Via Error Pages

fatfreecrm is vulnerable to information leakage via error pages. The vulnerability is possible because considerallrequestslocal is set to true by default in production mode, exposing the server setup information in 404 and 500 error pages...

Reflected XSS in error pages (NC-SA-2017-008)

Inadequate escaping of error messages leads to XSS vulnerabilities in multiple components.Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers...

mobile.yellowpages.com.eg Open Redirect vulnerability

Open Bug Bounty ID: OBB-233389 Description| Value ---|--- Affected Website:| mobile.yellowpages.com.eg Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

indianyellowpages.com XSS vulnerability

Vulnerable URL: http://www.indianyellowpages.com/search.php?term=catgty=comp Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 163090 VIP website status:| No Check indianyellowpages.c...

CVE-2017-7909

A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interface uses JavaScript to check client authentication and redirect unauthorized users. Attackers may intercept requests and bypass authentication to access...

Google Chrome Skia Heap Overflow Vulnerability

Google Chrome is a web browser developed by Google Inc. in the United States. Google Chrome Skia suffers from a heap overflow vulnerability that allows remote attackers to exploit this vulnerability by submitting a special WEB page and tricking the user into parsing it, which can crash the...

WordPress FancyProductDesigner Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress FancyProductDesigner plugin version 3.4.2, which allows attacker...

Atlassian Confluence 6.0.x < 6.0.7 Drafts diff REST Information Disclosure

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 6.0.x prior to 6.0.7. It is, therefore, affected by an information disclosure vulnerability in the Confluence drafts diff REST resource due to making available the page IDs or draft I...

yellowpages.com.sg XSS vulnerability

Vulnerable URL: http://www.yellowpages.com.sg/search/all/OPENBUGBOUNTY%22%27%2D%2D%21 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 95678 VIP website status:| No Check yellowpages.com.sg SSL connection:| Grade:...

Cross-site Scripting (XSS)

github.com/koding/koding is susceptible to cross-site scripting XSS attacks. It happens because encoding in static pages does not escape input string using validator.sanitize.xss...

The vulnerability of the Linux operating system, which allows a perpetrator to trigger a service failure or cause other effects.

The vulnerability in the Linux operating system’s crypto/ccm.c driver arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a local attacker to improperly interact with the CONFIGVMAPSTACK parameter, resulting in a service failure system...

The vulnerability of the Linux operating system, which allows a perpetrator to trigger a service failure or cause other effects

The vulnerability in the driver drivers/net/usb/rtl8150.c of the Linux operating system arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a local attacker to improperly interact with the CONFIGVMAPSTACK parameter, resulting in a servic...

Atlassian Confluence Authentication Bypass Vulnerability

Atlassian Confluence is a professional enterprise knowledge management and collaboration software from Atlassian Australia, which can also be used to build an enterprise WiKi. the software enables collaboration and knowledge sharing between team members. Atlassian Confluence suffers from an...

[SECURITY] Fedora 26 Update: tomcat-8.0.43-1.fc26

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...