4753 matches found
foreman: Information disclosure in provisioning template previews
A flaw was found in foreman's handling of template previews. An attacker with permissions to preview host templates can access the template preview for any host if they are able to guess the host name, disclosing potentially sensitive information...
February 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1 and Server 2012 R2 (KB 4074807)
February 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1 and Server 2012 R2 KB 4074807 Notice Update KB 4074807 has been released as part of the Preview of Quality Rollups for .NET Framework for February 2018. Parts ...
Two Nasty Outlook Bugs Fixed in Microsoft’s Feb. Patch Tuesday Update
Microsoft issued 50 security fixes as part of its February Patch Tuesday release, covering vulnerabilities in Windows, Office, Internet Explorer, Edge and its JavaScript engine ChakraCore. Fourteen of the vulnerabilities are labeled as critical, 34 as important and two as moderate. Two notable...
CVE-2018-6806
Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an x-marked://preview?text= URL. The value of the text parameter can include arbitrary JavaScript code, e.g., making XMLHttpRequest calls...
Discourse: Gaining access to private topics using quoting feature
Description Some topics have limited access to certain groups and users, and while there exists a validation for access on this topic, it can be bypassed by abusing a vulnerability in the "onebox" quoting feature. When pasting a link in a reply, if this link happens to be a link to another topic ...
CVE-2018-6465
The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php...
Flexible Poll SQL Injection Vulnerability
Flexible Poll is a dynamic online poll management system. A SQL injection vulnerability exists in Flexible Poll version 1.2. A remote attacker can inject SQL commands by sending the 'id' parameter to the index.php or mobilepreview.php file...
CVE-2018-5988
SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobilepreview.php or index.php...
PT-2018-17274
Name of the Vulnerable Software and Affected Versions: Flexible Poll version 1.2 Description: A SQL Injection issue exists, allowing exploitation via the id parameter to "mobile preview.php" or "index.php" API endpoints. Recommendations: For Flexible Poll version 1.2, avoid using the id parameter...
CVE-2018-6002
The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php warsoundypreview parameter...
CVE-2018-6001
The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php warsdyplpreview parameter...
Mail.ru: XSS ( Работа с письмами )
Заходим в почту. 2. Настройки - Работа с письмами. Получаем GET запросом входящие параметры...
Ubiquiti Inc.: Reflected XSS
Due to the lack of sanitisation in the commend area, with a especially crafted message, is possible to execute a XSS with the "preview" function. If a draft is save, is possible to exploit this bug using as and stored-XSS. The "New Discussion" page on the Spanish and Portuguese forums have a...
WordPress Z-URL Preview plugin <= 1.6.2 - Cross-Site Scripting (XSS) vulnerability
A Cross-Site Scripting XSS vulnerability found by Neorichi in WordPress Z-URL Preview plugin versions = 1.6.2. Vulnerable to Cross-Site Scripting via the class.zlinkpreview.php url parameter. Solution Update the WordPress Z-URL Preview plugin to the latest available version at least 2.0.0...
WordPress Z-URL Preview Plugin Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site. z-URL Preview plugin is used in one of the external links to get the plugin . A cross-site scripting vulnerability...
Design/Logic Flaw
Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration...
CVE-2017-1000491
CVE-2017-1000491 affects the Shiba markdown live preview app, version 1.1.0, with a cross-site scripting (XSS) vulnerability that can lead to code execution. The root cause is enabled Node.js integration in the app environment. Exploit specifics, affected platforms, and remediation are not provid...
CVE-2017-18012
The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter...