CVE-2018-8811

OpenCMS 10.5.3 is affected by a CSRF vulnerability in system/workplace/admin/accounts/user_role.jsp that can lead to privilege escalation by hijacking an admin session. Exploitation requires the attacker to have a CMS account with content-manager privileges; multiple public exploits (Exploit-DB, ...

CVE-2018-8811

Cross-site request forgery CSRF vulnerability in system/workplace/admin/accounts/userrole.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. Note: It is argued that OpenCMS allows only registered users...

CVE-2018-8815

Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...

PT-2018-18636 · Opencms · Opencms

Name of the Vulnerable Software and Affected Versions: OpenCMS version 10.5.3 Description: A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. The system stores uploaded content, such ...

openSUSE Security Update : Chromium (openSUSE-2018-264)

This update for Chromium to version 65.0.3325.162 fixes the following issues : - CVE-2017-11215: Use after free in Flash - CVE-2017-11225: Use after free in Flash - CVE-2018-6060: Use after free in Blink - CVE-2018-6061: Race condition in V8 - CVE-2018-6062: Heap buffer overflow in Skia -...

happynewyearquotes-2017.com XSS vulnerability

Open Bug Bounty ID: OBB-580890 Description| Value ---|--- Affected Website:| happynewyearquotes-2017.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Remote Code Execution (RCE)

Jupyter notebook is vulnerable to remote code execution RCE attacks. A malicious user can pass a HTML/SVG file to the application to inject and execute arbitrary javascript code to the notebook server...

Mozilla: Buffer overflow manipulating SVG animatedPathSegList (MFSA 2018-07)

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.7, Firefox ESR 52.7, and Firefox 59...

Mozilla Firefox Buffer Overflow Vulnerability (CNVD-2018-07092)

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. Mozilla Firefox suffers from a buffer overflow vulnerability when manipulating SVG animatedPathSegList via scripting. An attacker can exploit this vulnerability to cause a denial of service...

CVE-2018-5127

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.7, Firefox ESR 52.7, and Firefox 59...

UBUNTU-CVE-2018-5127

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.7, Firefox ESR 52.7, and Firefox 59...

Security vulnerabilities fixed in Firefox 59 — Mozilla

A buffer overflow can occur when manipulating the SVG animatedPathSegList through script. This results in a potentially exploitable crash. A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during editor operations. This results in a potentially...

Security vulnerabilities fixed in Firefox ESR 52.7 — Mozilla

A buffer overflow can occur when manipulating the SVG animatedPathSegList through script. This results in a potentially exploitable crash. A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandb...

chromium-browser: timing attack using svg filters

Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-6077

Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

opac-x-biblibeynes.biblix.net XSS vulnerability

Open Bug Bounty ID: OBB-575368 Description| Value ---|--- Affected Website:| opac-x-biblibeynes.biblix.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

enjoyoaxaca.mx XSS vulnerability

Open Bug Bounty ID: OBB-574986 Description| Value ---|--- Affected Website:| enjoyoaxaca.mx Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

mc.iherb.com XSS vulnerability

Open Bug Bounty ID: OBB-574863 Description| Value ---|--- Affected Website:| mc.iherb.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosur...

KLA11204 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities possibly to cause denial of service or spoof user interface. Below is a complete list of vulnerabilities: 1. Incorrect processing of AppMenifests can be exploited remotely to perfo...

Cross-site Scripting (XSS)

github.com/tus/tusd is vulnerable to cross-site scripting XSS attacks. These attacks are possible because the server will display any files given to it inline. This allows an attacker to upload a malicious SVG and have it execute when the URL is visited...