13584 matches found
CVE-2019-11078
MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI...
GHSA-926Q-WXR6-3CRQ Moderate severity vulnerability that affects roundup
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgihandler.py mishandle 404 errors...
Moderate severity vulnerability that affects roundup
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgihandler.py mishandle 404 errors...
April 9, 2019âKB4493451 (Monthly Rollup)
April 9, 2019âKB4493451 Monthly Rollup Applies To Windows Server 2012 Windows Embedded 8 Standard Improvements and fixes This security update includes improvements and fixes that were a part of update KB4489920 released March 19, 2019 and addresses the following issues: Addresses an issue that...
April 9, 2019âKB4493475 (OS Build 10240.18186)
April 9, 2019âKB4493475 OS Build 10240.18186 Applies To Windows 10 Improvements and fixes This update includes quality improvements. Key changes include: Addresses an issue that may cause applications that use MSXML6 to stop responding if an exception was thrown during node operations. Addresses ...
CVE-2019-9844
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...
Cross site scripting
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...
Cross-site Scripting (XSS)
roundup is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the value of uri is not sanitized, allowing XSS attacks to occur in frontends/roundup.cgi and roundup/cgi/wsgihandler.py...
PYSEC-2019-201
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgihandler.py mishandle 404 errors...
PYSEC-2019-201
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgihandler.py mishandle 404 errors...
CVE-2019-10904
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgihandler.py mishandle 404 errors...
Design/Logic Flaw
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgihandler.py mishandle 404 errors...
CVE-2019-10904
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgihandler.py mishandle 404 errors...
CVE-2019-10904
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgihandler.py mishandle 404 errors...
CVE-2019-10904
CVE-2019-10904 affects Roundup 1.6: XSS via the URI caused by improper 404 handling in the web front-end, specifically in frontend/roundup.cgi and roundup/cgi/wsgi_handler.py. Practical impact is client-side code execution due to crafted URIs. Exploitation details are not provided in the supplied...
PT-2019-12082
Name of the Vulnerable Software and Affected Versions Roundup version 1.6 Description The issue allows for XSS via the URI due to mishandling of 404 errors by frontends/roundup.cgi and roundup/cgi/wsgi handler.py. Recommendations For Roundup version 1.6, consider updating to a newer version that...
Grandstream IP PBX Appliance UCM6204 < 1.0.19.20 RCE
Binary data 700492.prm...
PT-2019-2304
Name of the Vulnerable Software and Affected Versions Envoy versions 1.9.0 and earlier Description The issue is related to errors in normalizing URI addresses. A remote attacker may exploit this by crafting a relative path, such as something/../admin, to bypass access control, for example, a bloc...
CVE-2018-18497
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This...
Atlassian Fisheye for Windows < 4.4.6, 4.5.x < 4.5.3 Remote Code Execution Vulnerability
According to its self-reported version, the installation of Atlassian Fisheye running on the remote Windows host is prior to 4.4.6 or 4.5.x prior to 4.5.3. It is, therefore, affected by a remote command execution vulnerability due to improper sanitization of characters in a Mercurial repository U...