8649 matches found
OpenJDK: non-constant time GCM authentication tag comparison (JCE, 8143945)
It was discovered that the GCM Galois/Counter Mode implementation in the JCE component in OpenJDK used a non-constant time comparison when comparing GCM authentication tags. A remote attacker could possibly use this flaw to determine the value of the authentication tag...
Cross-Site Scripting (XSS)
atlas-dashboardv2 is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the user input in the edit-tag function, allowing a malicious user to inject and execute arbitrary javascript...
Cross-Site Scripting (XSS)
atlas-dashboardv2 is vulnerable to DOM based cross-site scripting XSS attacks. The library does not sanitize user input in the edit-tag function, allowing a malicious user to inject and execute arbitrary javascript...
elle.com.hk XSS vulnerability
Vulnerable URL: http://www.elle.com.hk/tag/retr0"autofocusonfocus="alertxssposed'-confirmOPENBUGBOUNTY-'/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 50041 VIP website status:| ...
osCommerce TemplateMonster Plugin SQL Injection Vulnerability
osCommerce is an open source e-commerce program. A SQL injection vulnerability exists in the idtag parameter in the tagproducts.php page of the osCommerce plugin TemplateMonster. An attacker can exploit the vulnerability to inject or manipulate SQL queries in the backend database to obtain...
cnvs Canvas Cross-Site Scripting Vulnerability
cnvs.io Canvas is a blog publishing platform. An XSS cross-site scripting vulnerability exists in the title and content fields of the "Posts Add New" action and during the creation of new tags and users in Canvas, which can be exploited by attackers to steal sensitive information such as cookies...
Linux/x86 - Egg-hunter Shellcode (18 bytes)
Linux/x86 - Egg-hunter Shellcode 18 bytes. Shellcode exploit for Linx86 platform // Description: a 18 bytes egg hunter on contigous memory segments // // You are free to do whatever you want of this shellcode // // @phacktul / global start section .text start: mov eax, start ; we set a valid .tex...
CVE-2016-2104
Multiple cross-site scripting XSS vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via 1 the label parameter to admin/BunchDetail.do; 2 the packagename, 3 searchsubscribedchannels, or 4 channelfilter parameter to software/packages/NameOverview.d...
polizei-beratung.de XSS vulnerability
Vulnerable URL:...
DEBIAN-CVE-2017-7586
In libsndfile before 1.0.28, an error in the "headerread" function common.c when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file...
Cross-Site Scripting (XSS) in HTML tag
Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Cross Site Scripting XSS allows clients to inject scripts into a request and have th...
Sync Breeze v9.5.16 - Buffer Overflow Vulnerabilities
Document Title: =============== Sync Breeze v9.5.16 - Buffer Overflow Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2045 Video: https://www.vulnerability-lab.com/getcontent.php?id=2049 Release Date: ============= 2017-03-28 Vulnerabili...
CVE-2017-6069
Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter...
Stored Cross-Site Scripting Vulnerability in DuoDuoRebate.com System Tag Parameters
DuoDuo rebate system is for e-commerce rebate, shopping guide to provide solutions, is the open source PHP rebate site system. DuoDuo rebate website system V8.3UTF8 official version February 10, 2017 there are stored cross-site scripting vulnerabilities. Due to the tag parameter failed to filter ...
Yellow Pages Script 3.2 - 'category_id' SQL Injection
Exploit Title: Yellow Pages Script v3.2 - SQL Injection Google Dork: N/A Date: 11.03.2017 Vendor Homepage: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/yellow-pages-script/ Demo: http://demo.phpjabbers.com/index.php?demo=yps&front=1&lid=1 Version: 3.2 Tested on: Win7 x64, Kali...
seacms search.php code execution vulnerability
function parseIf$content if strpos$content,'if:'=== false return $content; else $labelRule = buildregx"if:.? .? end if","is"; $labelRule2="elseif"; $labelRule3="else"; pregmatchall$labelRule,$content,$iar; $arlen=count$iar0; $elseIfFlag=false; for$m=0;$mparseStrIf$strIf; $strThen=$iar2$m;...
The vulnerability of the library that handles system calls and core functions, glibc, allows a attacker to execute arbitrary code.
The vulnerability of the elfgetdynamicinfo function in the elf/dynamic-link.h file of the ld.so library, which provides system calls and core functions, is related to integer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely using a specially crafted EL...
GStreamer Multiple Function Denial of Service Vulnerability
GStreamer is an open source multimedia framework. GStreamer has a security vulnerability in the gstminiobjectunref/gsttaglistunref/gstmxfdemuxupdateessencetracks function. A remote attacker caused a denial of service...
ALPINE-CVE-2017-5845
The gstavidemuxparsencdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service invalid memory read and crash via a ncdt sub-tag that "goes behind" the surrounding tag...