Cross site scripting

Cross-site scripting XSS vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded picture...

CVE-2014-6420

Cross-site scripting XSS vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded picture...

CVE-2014-6420: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded picture...

HackerOne: profile-picture name parameter with large value lead to DoS for other users and programs on the platform

Summary: The issue persists as there are no text limitations for profile-picture name while uploading the profile-picture, these heavy text names can cause denial of service on different pages of hackerone. Description: I was checking the profile picture upload feature of hackerone and found out...

AUO SunVeillance Monitoring System Code Issue Vulnerabilities

AUO SunVeillance Monitoring System is an intelligent cloud-based PV monitoring solution from AUO Taiwan. AUO SunVeillance Monitoring System v1.1.9e is vulnerable to a code issue in the PictureManagemvc.aspx file. An attacker can exploit this vulnerability to upload files via modified authorizatio...

The vulnerability of the ReadDCMImage function (coders/dcm.c) and the ReadPICTImage function (coders/pict.c) in the console-based graphic editor ImageMagick allows a hacker to cause a service failure.

The vulnerability of the ReadDCMImage function coders/dcm.c and ReadPICTImage function coders/pict.c in the console-based graphic editor ImageMagick exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service...

CVE-2019-19206

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

CVE-2019-19206

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

CVE-2019-19206

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

CVE-2019-19206: Improper Neutralization of Input During Web Page Generation

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

PT-2019-15782 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr CRM/ERP version 10.0.3 Description: The issue allows for Stored XSS due to JavaScript execution in an SVG image used for a profile picture. This is specifically related to the "viewimage.php?file=" endpoint, where an attacker can...

AUO SunVeillance Monitoring System 1.1.9e - 'MailAdd' SQL Injection

Exploit Title: AUO SunVeillance Monitoring System 1.1.9e - 'MailAdd' SQL Injection Date: 2019-10-24 Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO SunVeillance Monitoring System all versions prior to v1.1.9e Tested on: It is a proprietary devices:...

HackerOne: ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pages

Summary: Hi team, I've found an issue on the profile picture upload feature of your asset - https://hackerone.com, which can allow a malicious attacker to perform an application wide denial of service attack. Description: I was playing with the profile picture upload feature, then i observed that...

CVE-2019-17256

IrfanView 4.53 allows a User Mode Write AV starting at DPX!ReadDPXW+0x0000000000001203...

Fedora 30 : glpi (2019-a1636592a3)

GLPI version 9.4.4 This is a security release, upgrading is highly recommended Non exhaustive list of changes : - security Prevent account takeover vulnerability , - security Prevent execution of XSS on rich text, - fix cache key lenght issues, - fix user picture removal at login, - several fixes...

Buffer overflow

Classic buffer overflow vulnerability while playing the specific video whose Decode picture buffer size is more than 16 in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

CVE-2019-2252: Buffer Copy without Checking Size of Input

Classic buffer overflow vulnerability while playing the specific video whose Decode picture buffer size is more than 16 in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

Unspecified vulnerability in pfSense widgetkey

pfSense is a set of network firewalls based on FreeBSD Linux. In pfSense version 2.4.4-p3, a security vulnerability exists in the widgets/widgets/picture.widget.php file. The vulnerability stems from the use of the widgetkey parameter without filtering, which can be exploited by an attacker to...

Image gallery suffers from denial of service vulnerability (CNVD-2019-30303)

Photo Gallery is an image viewing and management software that supports all formats. A denial of service vulnerability exists in Picture Gallery, which can be exploited by attackers to cause a denial of service...

Image gallery suffers from denial of service vulnerability (CNVD-2019-30306)

Photo Gallery is an image viewing and management software that supports all formats. A denial of service vulnerability exists in Picture Gallery, which can be exploited by attackers to cause a denial of service...