13584 matches found
PT-2018-15327
Name of the Vulnerable Software and Affected Versions PhotoRange Photo Vault version 1.2 Description The issue allows remote attackers to bypass intended GET restrictions via a brute-force approach. This is because the password is appended to the URI for authorization. For example, attackers can...
CVE-2018-20367
The "mall some commodity details: commodity consultation" component in WSTMart 2.0.8181212 has stored XSS via the consultContent parameter, as demonstrated by the index.php/home/goodsconsult/add.html URI...
Web Isolation Arbitrary Code Injection
The vulnerability of the software for preventing web threats exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor, operating remotely, to inject arbitrary code into the loaded web page using a specially crafted URI...
CVE-2018-19507
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...
Design/Logic Flaw
CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI...
Design/Logic Flaw
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...
CVE-2018-19598
CVE-2018-19598 affects Statamic 2.10.3. A stored/reflected-like XSS exists via the First Name or Last Name fields in an ‘Add new user’ request to the /users URI. Public exploitation details are not provided in the provided documents. No remediation details are included here.
CVE-2018-19507
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...
CVE-2018-19507
CMSimple 4.7.5 is affected by a stored/reflected XSS issue triggered by an admin request using the URI parameter ?file=config&action=array. The NVD entry indicates the vulnerability exists in the web application’s handling of user-supplied input, enabling HTML/script injection that can potentiall...
CVE-2018-19506
Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI...
Cross site scripting
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...
CVE-2018-20137
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI...
CVE-2018-20136
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...
Cisco Unified Communications Domain Manager Arbitrary Code Injection
The vulnerability of the Cisco Unified Communications Domain Manager relates to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted URI address from a remote location...
CVE-2018-20064
CVE-2018-20064 concerns doorGets 7.0, where a directory-traversal flaw lets remote attackers write arbitrary files. The root cause is a crafted request to dg-user/?controller=theme&action=edit&name=doorgets&file=../../1.txt%00 with content provided in theme_content_nofi, enabling arbitrary file w...
Mail.ru: XSS
Reflected XSS via URI in allods.mail.ru. allods.mail.ru belongs to extended scope...
[SECURITY] Fedora 28 Update: uriparser-0.9.0-1.fc28
Uriparser is a strictly RFC 3986 compliant URI parsing library written in C. uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license...
PT-2018-3358
Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 64 Description: The issue is related to a bypass of limitations on URIs allowed to WebExtensions by the browser.windows.create API. This can occur when a pipe in the URL field is used within the extension to load...
Code injection
IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the httpServletRequestauthenticate API when an unprotected URI is accessed. IBM X-Force ID: 153629...