195 matches found
CVE-2018-8069
QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI...
CVE-2018-8069
QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI...
CVE-2018-8069
QCMS 3.0 is affected by a cross-site scripting vulnerability: an attacker can inject arbitrary script via the webname parameter in the /backend/system.html URI. The issue is reported across multiple sources (NVD CVE-2018-8069 and Red Hat/CNVD entries). The root cause is improper handling/encoding...
CVE-2018-8069
QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI...
CVE-2018-8070
QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...
CVE-2018-8070
CVE-2018-8070 describes an XSS vulnerability in QCMS 3.0 triggered by the title parameter to the /guest/index.html URI. The issue is due to improper handling of user-supplied input in that parameter, enabling cross-site scripting. Multiple connected sources (Red Hat, CNVD, and others) confirm the...
QCMS Cross-Site Scripting Vulnerability
QCMS is an open source content management system CMS for creating responsive websites. A cross-site scripting vulnerability exists in QCMS version 3.0. A remote attacker can exploit this vulnerability by sending the 'webname' parameter to the /backend/system.html URI to inject arbitrary web scrip...
CVE-2018-8069: Improper Neutralization of Input During Web Page Generation
QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI...
CVE-2018-8070: Improper Neutralization of Input During Web Page Generation
QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...
The vulnerability of the Firefox browser allows a remote attacker to gain access to the dynamic memory of the process or trigger a service denial-of-service attack.
The vulnerability of the Firefox browser in the implementation of the QCMS component allows a malicious actor to gain access to confidential information from the dynamic memory of the process, or to trigger a service failure reading beyond the boundaries of the system by using an image that is...
The vulnerability of the Firefox ESR browser allows a malicious attacker to execute arbitrary code or trigger a service denial.
Mozilla Firefox ESR software contains a vulnerability in the qcmsprofilefrommemory function. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure by manipulating the web notification API component, thereby creating a custom ICC profile...
The vulnerability of the Firefox browser, which allows a malicious attacker to execute arbitrary code or trigger a service denial.
Mozilla Firefox’s software contains a vulnerability in the qcmsprofilefrommemory function. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure by manipulating the web notification API component, thereby creating a custom ICC profile...
The vulnerability of the SeaMonkey software package allows a malicious attacker to execute arbitrary code or cause a service failure.
The SeaMonkey software contains a vulnerability in the qcmsprofilefrommemory function. Exploiting this vulnerability allows an unauthorized attacker to execute arbitrary code or cause a service failure by manipulating the web notification API component, thereby creating a special ICC profile...
Horizon QCMS 4.0 'category' 参数SQL注入漏洞
受影响系统 Horizon QCMS Horizon QCMS 测试方法： -------------------------------------------------------------------------------- 警 告 以下程序方法可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！ http://host/download.php?category=%27%20union%20select%201,2,version,4,5,6%20--%202 建议：...
The vulnerability of the Firefox browser, which allows a perpetrator to gain access to protected information or cause a service failure
The vulnerability of the lutinverseinterp16 function in the QCMS library of the Firefox browser is caused by buffer overflow. Exploiting this vulnerability can allow a malicious actor to gain access to protected information or cause service failures using a specially crafted image...
Mozilla Firefox QCMS Library Buffer Overflow Vulnerability
Mozilla Firefox is an open source web browser. A security vulnerability exists in the 'lutinverseinterp16' function in the Mozilla Firefox QCMS library. A remote attacker could exploit specially crafted attributes in an image's ICC 4 profile to obtain sensitive information or conduct a...
CVE-2015-4504
The lutinverseinterp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information or cause a denial of service buffer over-read and application crash via crafted attributes in the ICC 4 profile of an image...
Design/Logic Flaw
The lutinverseinterp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information or cause a denial of service buffer over-read and application crash via crafted attributes in the ICC 4 profile of an image...
CVE-2015-4504
Mozilla Firefox contains a vulnerable entry for CVE-2015-4504 in the QCMS library: lut_inverse_interp16 allows remote attackers to read sensitive data or crash the browser via crafted ICC v4 profile attributes, due to an out-of-bounds read. Affected versions are Firefox before 41.0. Mitigation: u...
CVE-2015-4504: Improper Restriction of Operations within the Bounds of a Memory Buffer
The lutinverseinterp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information or cause a denial of service buffer over-read and application crash via crafted attributes in the ICC 4 profile of an image...