13584 matches found
CVE-2018-12630
NEWMARK aka New Mark NMCMS 2.1 allows SQL Injection via the sectid parameter to the /catalog URI...
CVE-2018-12630
CVE-2018-12630 affects NEWMARK NMCMS 2.1. The issue is a SQL Injection in the sect_id parameter of the /catalog URI, allowing an attacker to execute arbitrary SQL commands. Impact is high/critical (CVSS3 base 9.8; no auth, network access, no user interaction). Root cause: improper handling of use...
Cross site request forgery (csrf)
An issue was discovered in AKCMS 6.1. CSRF can add an admin account via a /index.php?file=account&action=manageaccounts&job=newaccount URI...
Open a file or URL on the target computer
This module will open any file or URL specified with the URI format on the target computer via the embedded commands such as 'open' or 'xdg-open'. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...
Cross-site Scripting (XSS)
javamelody-core is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization in the counter parameter when performing the clearcounter action through the /monitoring URI, causing XSS attacks...
Fedora Update for nodejs-uri-js FEDORA-2018-13e08f4b4a
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora 27 : nodejs-JSV / nodejs-uri-js (2018-13e08f4b4a)
Update to latest nodejs-uri-js for CVE fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...
CVE-2018-12104
Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...
CVE-2018-12104
Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...
Cross site scripting
Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...
CVE-2018-12104
Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...
[SECURITY] Fedora 27 Update: nodejs-uri-js-4.2.2-2.fc27
URI.js is an RFC 3986 compliant, scheme extendable URI parsing/validating/resolving library for all JavaScript environments browsers, Node.js, etc...
Fedora Update for nodejs-uri-js FEDORA-2018-373bbbd408
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
uri-js denial of service vulnerability
uri-js is a JavaScript library for parsing and validating URLs. A security vulnerability exists in the regular expressions used in uri-js 2.1.1 and earlier versions. An attacker can exploit the vulnerability to cause the program to hang and cause CPU usage to reach 100%...
CVE-2018-12432
JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...
Design/Logic Flaw
JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...
CVE-2018-12432
JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...
CVE-2018-12432
JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...
CVE-2018-12432
JavaMelody up to version 1.60.0 is vulnerable to XSS via the counter parameter in the clear_counter action at the /monitoring URI. The root cause is unsanitized input in the counter parameter, enabling attacker-controlled script injection. Documented affected component: javamelody-core (JavaMelod...