Microsoft SQL Server Management Studio xel File XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft SQL Server Management Studio. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

Microsoft Edge Hazardous URI Insufficient UI Warning Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page and perform a UI action. There are multiple issues with the way the...

Windows Shell Remote Code Execution Vulnerability

A remote code execution vulnerability exists when Windows Shell improperly handles URIs. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control o...

PT-2018-2079

Name of the Vulnerable Software and Affected Versions Windows Server 2016 Windows 10 Windows 10 Servers Description A remote code execution issue exists due to improper handling of URIs by the Windows Shell, allowing remote attackers to execute arbitrary code. This can be achieved through a...

PT-2018-11146

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 62 Description The issue allows the displayed address bar URL to be spoofed, potentially leading to user confusion. This is achieved by using a javascript: URI in combination with JavaScript to insert text...

Android Framework checkGrantUriPermissionLocked Privilege Escalation

The vulnerability of the checkGrantUriPermissionLocked function in the ActivityManagerService.java file of the Android operating system’s framework is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to increase their privileges through a...

CVE-2018-11784

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory e.g. redirecting to '/foo/' when the user requested '/foo' a specially crafted URL could be used to cause the redirect to be generated to any URI of the...

Sql injection

Multi-Tech FaxFinder before 5.1.6 has SQL Injection via a status/calldetails?oid= URI, allowing an attacker to extract the underlying database schema to further disclose other fax server information through different injection points...

CVE-2018-17562

Multi-Tech FaxFinder before 5.1.6 has SQL Injection via a status/calldetails?oid= URI, allowing an attacker to extract the underlying database schema to further disclose other fax server information through different injection points...

Apache Tomcat CVE-2018-11784 Open Redirection Vulnerability

Description Apache Tomcat is prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirect...

KLA11327 SB vulnerability in Apache Tomcat

A vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability via specially crafted URI to bypass security restrictions. Original advisories Apache Tomcat 7.x vulnerabilities Apache Tomcat 8.x vulnerabilities Apache Tomcat 9.x vulnerabilities Exploitation Public...

CVE-2018-17595

In the 5.4.0 version of the Fork CMS software, HTML Injection and Stored XSS vulnerabilities were discovered via the /backend/ajax URI...

CVE-2018-17595

In the 5.4.0 version of the Fork CMS software, HTML Injection and Stored XSS vulnerabilities were discovered via the /backend/ajax URI...

CVE-2018-17595

CVE-2018-17595 affects Fork CMS 5.4.0, where HTML Injection and Stored XSS are triggered through the /backend/ajax URI. The available connected sources confirm the vulnerability in the specified version and describe the attack class as HTML injection leading to stored XSS in Fork CMS’s backend AJ...

phpMyAdmin index.php Local File Inclusion (CVE-2018-12613)

A local file inclusion vulnerability exists in phpMyAdmin. The vulnerability is due to improper sanitization of the request URI. A remote, authenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successful exploitation could lead to information...

CVE-2018-17852

A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detaillisting URI...

CVE-2018-17835

An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI...

Cross site scripting

An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI...

CVE-2018-17852

A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detaillisting URI...

CVE-2018-17835

An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI...