CVE-2018-16955

The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting XSS. The content of the inhiredirect parameter, when prefixed with the https:// scheme, is unsafely reflected in a HTML META tag in the HTTP response. NOTE: this CVE is assigned by MIT...

Denial Of Service (DoS)

github.com/golang/net is vulnerable to denial of service. A panic: runtime error occurs in inBodyIM in parse.go when the html.Parse is called with an unclosed tag, resulting in a denial of service condition...

CVE-2018-17142

The html package aka x/net/html through 2018-09-17 in Go mishandles , leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call...

Pluck Cross-Site Scripting Vulnerability

Pluck is a simple content management system CMS written in PHP. A cross-site scripting vulnerability exists in Pluck version 4.7.7, which can be exploited by remote attackers to execute scripts via SVG files with Javascript code in the SCRIPT element...

Information Disclosure

neutron is vulnerable to information disclosure. The Agent OVS interface adds ports without a VLAN tag. This allows a port to become a trunk port and receive traffic from external networks or any other ports sending traffic on br-int, if the neutron-openvswitch-agent fails to set the VLAN tag...

Tor Browser 7.0.8 Information Disclosure

Hi, there is the details for CVE-2017-16541 Tor Browser information disclosure, More infos at: https://www.wearesegment.com/research/tormoil-deanonymize-tor-browser-users-with-automount/ Tor Browser version 7.0.8, and probably prior, for Mac OS X and Linux, is affected by an information disclosur...

GHSA-VJCJ-5G2R-VXQC Pandao editor.md vulnerable to XSS in IMG attributes

Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element...

XSS Vulnerability in ThinkLC Multiple Pages

ThinkLC is a classified information system developed by SaxueCMS. ThinkLC V4.0 and previous versions of multi-page XSS vulnerability, the vulnerability stems from the system fails to adequately filter img tags, an attacker can construct malicious img tags to exploit the vulnerability to obtain...

Mayan EDMS Cross-Site Scripting Vulnerability (CNVD-2019-09819)

Mayan EDMS is a document management system developed by software developer Roberto Rosario. The system supports electronic signatures, version control and optical character recognition. A cross-site scripting vulnerability exists in the Cabinets app in Mayan EDMS versions prior to 3.0.2, which ca...

MiniCMS Cross-Site Scripting Vulnerability (CNVD-2018-19088)

MiniCMS is a mini content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in the mc-admin/post.php file in MiniCMS versions prior to 1.10, which can be exploited by remote attackers to inject arbitrary Web script or HTML with the help of the 'tag'...

CVE-2018-16407

An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled...

PYSEC-2018-15

An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled...

PYSEC-2018-15

An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled...

CVE-2018-16407

CVE-2018-16407 affects Mayan EDMS before 3.0.3. The vulnerability is in the Tags app where tag label values are mishandled, causing cross-site scripting (XSS). The available documents do not provide exploitation details or a stated fix version beyond the 3.0.3 boundary. Exploitation specifics are...

CVE-2018-16407

An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled...

dille-kamille.be XSS vulnerability

Open Bug Bounty ID: OBB-671063 Description| Value ---|--- Affected Website:| dille-kamille.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

RHEL 6 / 7 : eap7-jboss-ec2-eap (RHSA-2016:1840)

An update for eap7-jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 and Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

BSA-2018-700

Security Advisory ID : BSA-2018-700 Component : Apache Struts 2 Revision : 1.0: Final Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when using results with no namespace and in same time, its upper actions have no or wildcard namespace. Same...

Remote Code Execution (RCE)

struts2-core is vulnerable to remote code execution RCE attacks. These attacks are possible when using a namespace or url tag which doesn't have a value and action set and where its upper action configuration is using a wildcard namespace or has no namespace...

CVE-2018-11776

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true either by user or a plugin like Convention Plugin and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace...