13584 matches found
PT-2018-6052 · Github · Uri.Js
Name of the Vulnerable Software and Affected Versions: uri-js versions 2.1.1 and earlier Description: The issue arises from a regular expression used by uri-js to validate URLs, which is vulnerable to redos. This vulnerability causes the program to hang and results in 100% CPU usage when attempti...
Design/Logic Flaw
ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules - Manage modules - edit" action to the manager/ URI...
CVE-2018-11572
ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules - Manage modules - edit" action to the manager/ URI...
PT-2018-10676
Name of the Vulnerable Software and Affected Versions ClipperCMS version 1.3.3 Description The issue concerns an XSS vulnerability in the "Module name" field, specifically when performing a "Modules - Manage modules - edit" action, which is accessible via the manager/ URI. Recommendations For...
CVE-2018-11572
ClipperCMS 1.3.3 has an XSS vulnerability in the Module name field accessed via Modules → Manage modules → edit (manager/ URI). The issue allows injection of arbitrary web script or HTML (remote exploitation). Root cause: improper sanitization of the module name input. Impact: potential script ex...
CVE-2018-11572
ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules - Manage modules - edit" action to the manager/ URI...
Apache httpd FilesMatch Directive Security Restriction Bypass (CVE-2017-15715)
A security policy bypass vulnerability exists in Apache httpd. A remote attacker can exploit this vulnerability by sending a HTTP request with crafted URI to the remote HTTP server. Successful exploitation could result security policy bypass and arbitrary file upload...
CVE-2018-11528
WUZHI CMS 4.1.0 has SQL Injection via an api/smscheck.php?param= URI...
CVE-2018-11528
CVE-2018-11528 affects WUZHI CMS 4.1.0 and is a SQL Injection in the API endpoint at api/sms_check.php?param= URI. The root cause is unsafe handling of the param parameter leading to arbitrary SQL execution. Impact described in public records includes the ability to run arbitrary SQL commands on ...
CVE-2018-11528
WUZHI CMS 4.1.0 has SQL Injection via an api/smscheck.php?param= URI...
Tor: Tor Browser: iframe with `data:` uri has access to parent window
Version: 7.5.4 based on Mozilla Firefox 52.8.0 Tested with standard security slider. However, it's likely to be possible with a higher security level. Summary In Tor Browser iframe with data:uri inherits the origin of parent window. That leads to iframe has access to parent window. PoC Iframe cou...
Cross site request forgery (csrf)
A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= URI, as demonstrated by adding a new quotation...
CVE-2018-11442
A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= URI, as demonstrated by adding a new quotation...
CVE-2018-11442
CVE-2018-11442 concerns a Cross‑Site Request Forgery in EasyService Billing 1.0. The vulnerability is triggered via the URI quotation-new3-new2.php?add=true&id= and can enable unauthorized actions on behalf of an authenticated user (CSRF in the quotation process). Several connected records descri...
CVE-2018-11442: Cross-Site Request Forgery (CSRF)
A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= URI, as demonstrated by adding a new quotation...
Design/Logic Flaw
An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances a redirect issued with a URI containing a username and password when the Location: header cannot be used, a lack of escaping the user-info component of the URI could result in an XSS vulnerability...
CVE-2018-11328
An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances a redirect issued with a URI containing a username and password when the Location: header cannot be used, a lack of escaping the user-info component of the URI could result in an XSS vulnerability...
PT-2018-10487
Name of the Vulnerable Software and Affected Versions Joomla! Core versions prior to 3.8.8 Description A lack of escaping the user-info component of the URI could result in an XSS issue under specific circumstances, such as when a redirect is issued with a URI containing a username and password,...
CVE-2018-11328: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances a redirect issued with a URI containing a username and password when the Location: header cannot be used, a lack of escaping the user-info component of the URI could result in an XSS vulnerability...