Routers2 2.24 Cross Site Scripting

Exploit Title: Routers2 2.24 - Reflected Cross-Site Scripting Date: 18-01-18 Vendor Homepage: http://www.steveshipway.org/software/ Software Link: https://github.com/sshipway/routers2 Version: 2.24 CVE: CVE-2018-6193 Platform: Perl Category: webapps Exploit Author: Lorenzo Di Fuccia Contact:...

Routers2 2.24 - Cross-Site Scripting

Routers2 2.24 - Cross-Site Scripting Exploit Title: Routers2 2.24 - Reflected Cross-Site Scripting Date: 18-01-18 Vendor Homepage: http://www.steveshipway.org/software/ Software Link: https://github.com/sshipway/routers2 Version: 2.24 CVE: CVE-2018-6193 Platform: Perl Category: webapps Exploit...

CVE-2017-18093

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the location...

Cross site scripting

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the location...

PT-2018-6672

Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.4.3 and prior to 4.5.0 Description: The issue allows remote attackers with permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross-site scripting XSS...

CVE-2017-18093: Improper Neutralization of Input During Web Page Generation

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the location...

Design/Logic Flaw

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems where rhshellfix was enabled, and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by th...

Online Voting System Authentication Bypass Vulnerability

Online Voting System is an online voting system. A security vulnerability exists in the profile section of Online Voting System version 1.0. The vulnerability can be exploited by an attacker to set passwords for other accounts...

CVE-2018-6180

CVE-2018-6180 describes an authentication bypass in the Online Voting System 1.0 where an unauthenticated user can set an arbitrary password for other accounts via the profile section. The root cause is a flaw that allows password updates based on an incremental identifier without validating the ...

JVN#36048131: Multiple I-O DATA network devices incorporating "MagicalFinder" vulnerable to OS command injection

"MagicalFinder" provided by I-O DATA DEVICE, INC. is a IP address setting tool to for I-O DATA network devices such as routers, network cameras, strages, etc. Multiple I-O DATA network devices that incorporate "MagicalFinder" contain an OS command injection vulnerability CWE-78. Impact An attacke...

CVE-2015-2186

The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORSORIGINALLOWALL setting. Note: this vulnerability was fixed on 2015-03-06, but the version number was not...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through SVG files if enableSvg is set. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script...

WS-2018-0631

In “cockroachdb/cockroach”, v1.2-alpha.20171211 to v2.0-alpha.20180129 allow the setting of a user's password in an insecure mode, thus risking the confidealty...

PiDense - Monitor Illegal Wireless Network Activities (Fake Access Points)

Monitor illegal wireless network activities. Similar SSID broadcasts Same SSID broadcasts Calculates unencrypted wireless networks density Watches SSID broadcasts at the blacklist. Capabilities Now Calculates Unencrypted wireless network density Finds same ssid, different encryption Working...

CVE-2018-5721

Stack-based buffer overflow in the ejupdatevariables function in router/httpd/web.c on ASUS routers when using software from https://github.com/RMerl/asuswrt-merlin allows web authenticated attackers to execute code via a request that updates a setting. In ejupdatevariables, the length of the...

CVE-2018-5721

Stack-based buffer overflow in the ejupdatevariables function in router/httpd/web.c on ASUS routers when using software from https://github.com/RMerl/asuswrt-merlin allows web authenticated attackers to execute code via a request that updates a setting. In ejupdatevariables, the length of the...

CVE-2017-16551

K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way...

CVE-2017-16555

K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way...

CVE-2017-16862

The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery CSRF vulnerability...

Cross-site request forgery(CSRF) in the IncomingMailServers resource - CVE-2017-16862

The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery CSRF vulnerability...