13584 matches found
CVE-2018-11616
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2018-11616: Improper Neutralization of Special Elements used in an OS Command
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Cross site scripting
Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI...
Directory traversal
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI...
CVE-2018-16134
CVE-2018-16134 affects CyBroHttpServer v1.0.3 by Cybrotech. The vulnerability is a reflected XSS via a crafted URI, enabling script injection in the server response. Public PoCs/exploits exist (e.g., Exploit-DB, PacketStorm) showing a simple payload. CVSS scores in the records: CVSSv2 base 4.3 (...
PT-2018-13417
Name of the Vulnerable Software and Affected Versions Cybrotech CyBroHttpServer version 1.0.3 Description The issue allows Directory Traversal via a ../ in the URI. This means an attacker could potentially access files or directories outside the intended directory structure by manipulating the UR...
PT-2018-13418
Name of the Vulnerable Software and Affected Versions Cybrotech CyBroHttpServer version 1.0.3 Description The issue allows for cross-site scripting XSS attacks via a URI. Recommendations For Cybrotech CyBroHttpServer version 1.0.3, update to a version that fixes this issue, however at the moment,...
CVE-2018-16133: Improper Limitation of a Pathname to a Restricted Directory
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI...
CVE-2018-16134: Improper Neutralization of Input During Web Page Generation
Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI...
Supreme Directory Theme <= 1.1.8 - Unauthenticated Cross-Site Scripting (XSS)
This theme has a parameter, s, that allows execute a xss payload: " 1. Install the theme 2. Access the web on another browser 3. Write this uri: website.com/?s="alert0...
Supreme Directory Theme <= 1.1.8 - Unauthenticated Cross-Site Scripting (XSS)
This theme has a parameter, s, that allows execute a xss payload: " PoC 1. Install the theme 2. Access the web on another browser 3. Write this uri: website.com/?s="...
CVE-2018-11511
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'albumid' or 'scope' parameter via a photo-gallery/api/album/treelists/ URI...
CVE-2018-15138
Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs...
EKFiddle - A Framework Based On The Fiddler Web Debugger To Study Exploit Kits, Malvertising And Malicious Traffic In General
A framework based on the Fiddler web debugger to study Exploit Kits, malvertising and malicious traffic in general. Installation Download and install the latest version of Fiddler https://www.telerik.com/fiddler Special instructions for Linux and Mac here:...
CVE-2018-14837
Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI...
CVE-2018-14837
Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI...
CVE-2018-14837
Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI...
[SECURITY] Fedora 27 Update: libxml2-2.9.8-4.fc27
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...