6690 matches found
CVE-2018-11511
The provided connected documents confirm that ASUSTOR ADM 3.1.0.RFQ3 is vulnerable to SQL injection in the photo gallery’s tree lists endpoint: /photo-gallery/api/album/tree_lists/, via the album_id or scope parameters. This allows an attacker to inject arbitrary SQL commands, potentially leading...
CVE-2018-11511
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'albumid' or 'scope' parameter via a photo-gallery/api/album/treelists/ URI...
CVE-2018-11511
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the ‘albumid’ or ‘scope’ parameter via a photo-gallery/api/album/treelists/ URI. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed...
marathon-photo.ru XSS vulnerability
Open Bug Bounty ID: OBB-661648 Description| Value ---|--- Affected Website:| marathon-photo.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
fotoloco.fr XSS vulnerability
Open Bug Bounty ID: OBB-660419 Description| Value ---|--- Affected Website:| fotoloco.fr Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A...
photo-club.es XSS vulnerability
Open Bug Bounty ID: OBB-648445 Description| Value ---|--- Affected Website:| photo-club.es Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Samsung Investigates Claims of Spontaneous Texting of Images to Contacts
Samsung says it isn’t seeing any software or hardware issues after a slew of Samsung phone users reported that their devices are randomly sending camera roll photos to their contacts without permission. Users took to Reddit and Samsung’s official forums over the past week to complain that their...
Yxcms Arbitrary File Deletion Vulnerability
YXcms is a PHP and MySQL based enterprise building content management system CMS. An arbitrary file deletion vulnerability exists in protected/apps/admin/controller/photoController.php in YXcms 1.4.7. A remote attacker can exploit this vulnerability by sending the 'picname' parameter via...
CVE-2018-13025
protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter...
FastStone Image Viewer Denial of Service Vulnerability (CNVD-2018-14264)
FastStone Image Viewer is an image viewer that supports image browsing, format conversion, editing and more. A security vulnerability exists in FastStone Image Viewer version 6.2, which originates from the FSViewer.exe program failing to properly handle malformed JPEG files. An attacker can explo...
[SECURITY] Fedora 28 Update: LibRaw-0.18.12-1.fc28
LibRaw is a library for reading RAW files obtained from digital photo cameras CRW/CR2, NEF, RAF, DNG, and others. LibRaw is based on the source codes of the dcraw utility, where part of drawbacks have already been eliminated and part will be fixed in future...
Synology Photo Station Cross-Site Request Forgery Vulnerability
Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A cross-site request forgery vulnerability exists in the admin/user.php file in Synology Photo Station versions prior to 6.8.5-3471 and prior to 6.3-2975. A remote attacker can exploit the...
Synology Photo Station elevation of privilege vulnerability (CNVD-2018-11290)
Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A security vulnerability exists in Synology Photo Station versions prior to 6.8.5-3471 and prior to 6.3-2975. A remote attacker can exploit the vulnerability to perform a power lifting attack...
Schools Alert Management Script - SQL Injection
Exploit Title: Schools Alert Management Script - SQL Injection Date: 2018-06-07 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web Application Exploit Author: M3@Pandas Web:...
Schools Alert Management Script - SQL Injection
Schools Alert Management Script - SQL Injection Exploit Title: Schools Alert Management Script - SQL Injection Date: 2018-06-07 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web Application Exploit...
CVE-2018-8926
Permissive regular expression vulnerability in synophotodsmuser in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter...
CVE-2018-8925
Cross-site request forgery CSRF vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the 1 username, 2 password, 3 admin, 4 action, 5 uid, or 6 modifyadmin parameter...
CVE-2018-8926
Permissive regular expression vulnerability in synophotodsmuser in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter...
CVE-2018-8925
Cross-site request forgery CSRF vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the 1 username, 2 password, 3 admin, 4 action, 5 uid, or 6 modifyadmin parameter...
CVE-2018-8926
Permissive regular expression vulnerability in synophotodsmuser in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter...