CVE-2018-12432: Improper Neutralization of Input During Web Page Generation

JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...

Ximdex cross-site scripting vulnerability (CNVD-2018-14422)

Ximdex is a content and data management system. The system includes features such as an intelligent search engine, information aggregation, image and text recognition, etc. The DMS component is one of the data management components. A cross-site scripting vulnerability exists in the /edit URI of...

Cross site scripting

The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter...

CVE-2018-12273

The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter...

CVE-2018-12263

portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI...

CVE-2018-12263

The CVE-2018-12263 entry affects portfolioCMS 1.0.5, with a vulnerability in the admin/portfolio.php?newpage=true URI that allows uploading arbitrary .php files. The connected CNVD/NVD/OSV records confirm this behavior, citing a file-upload vulnerability in portfolioCMS 1.0.5. The underlying root...

CVE-2018-12263

portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI...

Mail.ru: Stealing Arbitrary Private Files of MyMail App

It was possible for local malware application to steal sensitive local files of MyMail / Mail.Ru Mail application due to specifics of file:// schema URI handling in SharingActivity...

jira.unite.un.org XSS vulnerability

Open Bug Bounty ID: OBB-630879 Description| Value ---|--- Affected Website:| jira.unite.un.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PT-2018-10700

Name of the Vulnerable Software and Affected Versions Tencent Foxmail version 7.2.9.115 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The fl...

Tencent Foxmail URI parsing Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing o...

CVE-2017-5450

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorrectly, making the resulting location less visibly a spoofed site and showing an incorrect domain in appended notifications. This vulnerability affects Firefox...

CVE-2017-5450

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorrectly, making the resulting location less visibly a spoofed site and showing an incorrect domain in appended notifications. This vulnerability affects Firefox...

Design/Logic Flaw

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorrectly, making the resulting location less visibly a spoofed site and showing an incorrect domain in appended notifications. This vulnerability affects Firefox...

CVE-2017-5450

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorrectly, making the resulting location less visibly a spoofed site and showing an incorrect domain in appended notifications. This vulnerability affects Firefox...

CVE-2017-5450

CVE-2017-5450 describes a spoofing vulnerability in Firefox for Android where the address bar can be spoofed via a javascript: URI due to incorrect parsing of the base URL. Affected: Firefox for Android versions

CVE-2018-12111

Cross-site scripting XSS vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the /wt3/mydocs.php URI...

Cross site scripting

Cross-site scripting XSS vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the /wt3/mydocs.php URI...

CVE-2018-12111

The provided connected sources confirm CVE-2018-12111 affects Canon PrintMe EFI webinterface, specifically the /wt3/mydocs.php URI. The vulnerability is a Cross-Site Scripting (XSS) flaw where an attacker can inject arbitrary script/HTML via PATH_INFO, enabling code execution in the context of th...

IBM InfoSphere Information Server Cross-Site Request Forgery Vulnerability (CNVD-2018-17155)

IBM InfoSphere Information Server is the information integration platform. A cross-site request forgery vulnerability exists in the IBM InfoSphere Information Server component, which allows remote attackers to exploit the vulnerability to construct malicious URIs, bait a request, and can be used ...