13584 matches found
Default configuration
When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages pages with a logon agent or a confirm box, the BIG-IP APM may disclose configuration information such as partition and agent names via URI parameters...
CVE-2018-5544
CVE-2018-5544 affects F5 BIG-IP APM rendering pages with a logon agent or confirm box, potentially disclosing configuration details (partition/agent names) via URI parameters. Affected: BIG-IP APM 13.0.0–13.1.1 (also 12.1.0–12.1.3 per advisory table). 12.x is not vulnerable per the table; 14.x fi...
Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection
Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection Exploit Title: Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection Date: 2018-07-20 Software Link: https://github.com/nystudio107/craft-seomatic Exploit Author: Sebastian Kriesten 0xB455 Contact:...
PT-2018-17038
Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM versions 12.1.0 through 12.1.3 F5 BIG-IP APM versions 13.0.0 through 13.1.1 Description The issue occurs when the F5 BIG-IP APM renders certain pages, such as those with a logon agent or a confirm box, potentially disclosing...
CVE-2018-5544: Exposure of Sensitive Information to an Unauthorized Actor
When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages pages with a logon agent or a confirm box, the BIG-IP APM may disclose configuration information such as partition and agent names via URI parameters...
Insufficient URI encoding in restforce
A flaw in how restforce constructs URL's may allow an attacker to inject additional parameters into Salesforce API requests. Impact ------ This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods...
Code injection
wancms 1.0 through 5.0 allows remote attackers to cause a denial of service resource consumption via a checkcode aka verification code URI in which the values of fontsize, width, and height are large numbers...
CVE-2018-14596
wancms 1.0 through 5.0 allows remote attackers to cause a denial of service resource consumption via a checkcode aka verification code URI in which the values of fontsize, width, and height are large numbers...
CVE-2018-14596
wancms 1.0 through 5.0 allows remote attackers to cause a denial of service resource consumption via a checkcode aka verification code URI in which the values of fontsize, width, and height are large numbers...
CVE-2018-14596
wancms 1.0 through 5.0 allows remote attackers to cause a denial of service resource consumption via a checkcode aka verification code URI in which the values of fontsize, width, and height are large numbers...
CVE-2018-14596: Uncontrolled Resource Consumption
wancms 1.0 through 5.0 allows remote attackers to cause a denial of service resource consumption via a checkcode aka verification code URI in which the values of fontsize, width, and height are large numbers...
Regular Expression Denial Of Service in uri-js
Affected versions of uri-js is susceptible to a regular expression denial of service vulnerability when user input is sent to the .parse method. Recommendation Update to v3.0.0 or later...
GHSA-333W-RXJ3-F55R Regular Expression Denial Of Service in uri-js
Affected versions of uri-js is susceptible to a regular expression denial of service vulnerability when user input is sent to the .parse method. Recommendation Update to v3.0.0 or later...
Vanilla: [allhiphop.vanillacommunities.com] XSS Request-URI
Summary: Reflected XSS via Request-URI for Internet Explorer. Steps to reproduce: 1. Open URL in Internet Explorer tested on IE 11 https://blackfan.ru/x?r=https://allhiphop.vanillacommunities.com/xxx%22-alertdocument.domain-%22xxx/%252e%252e/ blackfan.ru/x - a simple redirection script that is...
feedparser Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in feedparser.py in Universal Feed Parser aka feedparser or python-feedparser 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI...
Cross site scripting
An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server"...
CVE-2018-14418
In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI...
Sql injection
In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI...
CVE-2018-14418
Summary: CVE-2018-14418 affects Msvod Cms v10 and is a SQL Injection vulnerability exploitable via the images/lists?cid= URI. The root cause is unsanitized input in the cid parameter, enabling arbitrary SQL commands. Public exploit content shows how payloads can retrieve database, user, and versi...