13584 matches found
Design/Logic Flaw
libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...
CVE-2018-14399
libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...
PT-2018-12490 · Phpcms · Phpcms
Name of the Vulnerable Software and Affected Versions: PHPCMS version 9.6.0 Description: The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved by sending a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the...
Regular Expression Denial Of Service (ReDoS)
validator is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a long URI to the isDataURI function to cause a ReDoS attack...
WolfSight CMS SQL Injection Vulnerability
WolfSight CMS is a content management system. The system features news management, e-commerce management, payment management and document editing. A SQL injection vulnerability exists in WolfSight CMS version 3.2. A remote attacker can exploit this vulnerability by sending PATHINFO to the default...
Sql injection
WolfSight CMS 3.2 allows SQL injection via the PATHINFO to the default URI...
CVE-2018-14012
WolfSight CMS 3.2 allows SQL injection via the PATHINFO to the default URI...
CVE-2018-14012
CVE-2018-14012 concerns WolfSight CMS 3.2, which is vulnerable to an SQL injection via PATH_INFO sent to the default URI. The connected records confirm the affected product/version and the injection vector, without listing explicit root-cause code or patched versions. CVSS scores indicate a very ...
A WordPress SPAMbot Wants You to Bet on the 2018 FIFA World Cup
Our researchers recently picked up on a spike in SPAM activity directed at sites powered by WordPress, which, naturally, led them to take a closer look. Turns out the attack was launched by a botnet and implemented in the form of comment SPAM - meaningless, generic text generated from a template...
PT-2018-12277
Name of the Vulnerable Software and Affected Versions WolfSight CMS version 3.2 Description The issue allows SQL injection via the PATH INFO to the default URI. Recommendations For WolfSight CMS version 3.2, consider restricting access to the default URI to minimize the risk of exploitation. As a...
CVE-2018-14012: Improper Neutralization of Special Elements used in an SQL Command
WolfSight CMS 3.2 allows SQL injection via the PATHINFO to the default URI...
Insufficient Input Validation in Bleach module in Intel® Distribution for Python (IDP) version IDP 2018 Update 2 potentially allows an unprivileged user to bypass URI sanitization and cause a Denial of Service via local vector
Summary: Insufficient Input Validation in Bleach module in Intel® Distribution for Python IDP version IDP 2018 Update 2 potentially allows an unprivileged user to bypass URI sanitization and cause a Denial of Service via local vector. Description: A vulnerable version of the Mozilla Bleach librar...
Directory traversal
Directory traversal vulnerability in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and ...
CVE-2018-6830: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and ...
Cross site scripting
An issue was discovered in BEdita before 3.7.0. A cross-site scripting XSS attack occurs via a crafted pages/showObjects URI, as demonstrated by appending a payload to a pages/showObjects/2/0/0/leafs URI...
CVE-2015-9260
CVE-2015-9260 affects BEdita prior to 3.7.0. A cross-site scripting (XSS) vulnerability is triggered via a crafted pages/showObjects URI, demonstrated by appending a payload to pages/showObjects/2/0/0/leafs. Technical details in connected sources confirm the vulnerability exists in versions befor...
CVE-2015-9260: Improper Neutralization of Input During Web Page Generation
An issue was discovered in BEdita before 3.7.0. A cross-site scripting XSS attack occurs via a crafted pages/showObjects URI, as demonstrated by appending a payload to a pages/showObjects/2/0/0/leafs URI...
ownCloud: Possible to steal any protected files on Android
Hi. I have found an issue which allows to retrieve any files from /data/data/com.owncloud.android/ directory. The problem is in exported activity com.owncloud.android.ui.activity.ReceiveExternalFilesActivity which accepts a URI to download files. I see that you've added verification path...
