2516 matches found
CVE-2018-20683
commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P...
SUSE SLED15 / SLES15 Security Update : wireshark (SUSE-SU-2018:1988-1)
This update for wireshark fixes vulnerabilities that could be used to trigger dissector crashes or cause dissectors to go into large infinite loops by making Wireshark read specially crafted packages from the network or capture files bsc1094301. This includes : - CVE-2018-11356: DNS dissector cra...
Q'center Virtual Appliance Cross-Site Scripting Vulnerability
QNAP Q'center Virtual Appliance is a virtual appliance from QNAP Systems for deploying Q'center QNAP NAS Management Platform in virtual environments such as Microsoft Hyper-V, VMware ESXi and Workstation. A cross-site scripting vulnerability exists in QNAP Q'center Virtual Appliance version...
CVE-2018-0723
Cross-site scripting XSS vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0724...
q-lab.com XSS vulnerability
Open Bug Bounty ID: OBB-709098 Description| Value ---|--- Affected Website:| q-lab.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...
Hasan MWB 1.0 Time-Based SQL Injection
=================================================== Hasan MWB v1.0 - Multiple Time-Based SQL Injections =================================================== Exploit Title: Hasan MWB v1.0 - Multiple Time-Based SQL Injections Date: 12-04-2018 Category: Webapps Author: Socket0x03 Alvaro J. Gene Email...
CVE-2018-19458
In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246...
PT-2018-14966
Name of the Vulnerable Software and Affected Versions PHP Proxy version 3.0.3 Description The issue allows any user to read files from the server without authentication due to a Local File Inclusion LFI vulnerability. This is achieved through the "index.php?q=file:///" URI. Recommendations For PH...
CVE-2018-19458: Improper Authentication
In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246...
SUSE SLES12 Security Update : wireshark (SUSE-SU-2018:2891-2)
This update for wireshark to version 2.4.9 fixes the following issues : Wireshark was updated to 2.4.9 bsc1094301, bsc1106514. Security issues fixed : CVE-2018-16058: Bluetooth AVDTP dissector crash wnpa-sec-2018-44 CVE-2018-16056: Bluetooth Attribute Protocol dissector crash wnpa-sec-2018-45...
q-pit.kyushu-u.ac.jp XSS vulnerability
Open Bug Bounty ID: OBB-687088 Description| Value ---|--- Affected Website:| q-pit.kyushu-u.ac.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
UBUNTU-CVE-2018-18025
In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file...
Google Patches Critical Vulnerabilities in Android OS
Google patched six critical remote code execution flaws in its Android operating system as part of its October Android Security Bulletin. Four of those remote code execution flaws are tied to Android’s Media framework and impact a wide range of Android devices including Google’s Pixel and Nexus...
PT-2018-13442
Name of the Vulnerable Software and Affected Versions Q Bee MultiSensor Camera versions 4.16.4 and earlier Q Bee Cam application versions 1.0.5 and earlier for Android Swisscom Home application versions 10.7.2 and earlier for Android Description The issue allows an attacker to reuse cookies and...
CVE-2018-17070: Cross-Site Request Forgery (CSRF)
An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay...
CVE-2018-17069: Cross-Site Request Forgery (CSRF)
An issue was discovered in UNL-CMS 7.59. A CSRF attack can create new content via ?q=node%2Fadd%2Farticle&render=overlay&render=overlay...
CVE-2018-15566
tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter...
CVE-2018-15566
tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter...
PT-2018-13091
Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description The issue allows for XSS via the q parameter in the "admin.php/article/index.html" API endpoint. Recommendations For versions prior to 2017-05-25, avoid using the q parameter in the...