PT-2018-18987

Name of the Vulnerable Software and Affected Versions Coremail XT3.0 Description The issue concerns a stored XSS in the register.jsp file of Coremail XT3.0. This is demonstrated by the third form field to a URI under register/. Recommendations For Coremail XT3.0, update the register.jsp file to...

citroen.com.gh XSS vulnerability

Open Bug Bounty ID: OBB-596457 Description| Value ---|--- Affected Website:| citroen.com.gh Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

OpenResty Access Restriction Bypass Vulnerability

OpenResty is a high-performance Web platform based on Nginx and Lua , its internal integration of a large number of sophisticated Lua libraries , third-party modules and most of the dependencies . An access restriction bypass vulnerability exists in OpenResty versions prior to 1.13.6.1. The...

CVE-2018-9230

In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.geturiargs and ngx.req.getpostargs functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall...

CVE-2018-9230

In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.geturiargs and ngx.req.getpostargs functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall...

Design/Logic Flaw

DISPUTED In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.geturiargs and ngx.req.getpostargs functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application...

CVE-2018-9230

In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.geturiargs and ngx.req.getpostargs functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall...

Homematic CCU2 2.29.23 Remote Command Execution

!/usr/bin/ruby Exploit Title: Homematic CCU2 Remote Command Execution Date: 28-03-18 Exploit Author: Patrick Muench, Gregor Kopf Vendor Homepage: http://www.eq-3.de Software Link: http://www.eq-3.de/service/downloads.html?id=268 Version: 2.29.23 CVE : 2018-7297 Description:...

[20180508] - Core - Possible XSS attack in the redirect method

Under specific circumstances a redirect issued with a URI containing a username and password when the Location: header cannot be used, a lack of escaping the user-info component of the URI could result in a XSS vulnerability...

Design/Logic Flaw

Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run...

CVE-2018-5224

Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to create a repository in Bamboo, edit an existing plan in Bamboo that has a non-linked Mercurial repository,...

CVE-2018-5224

CVE-2018-5224 affects Atlassian Bamboo on Windows. The issue arises from improper handling of Mercurial repository URIs, allowing an attacker with repository/plan permissions to execute arbitrary code on vulnerable Bamboo Windows hosts. Affected versions are Bamboo 2.7.0–6.3.2 and 6.4.0–6.4.1 on ...

CVE-2018-9122

In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI...

Cross site scripting

In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI...

CVE-2018-9122

In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI...

CVE-2018-9122

In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI...

CVE-2018-5223: Improper Input Validation

Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run...

CVE-2018-5224: Improper Input Validation

Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to create a repository in Bamboo, edit an existing plan in Bamboo that has a non-linked Mercurial repository,...

PT-2018-16815

Name of the Vulnerable Software and Affected Versions Bamboo versions 2.7.0 through 6.3.2 Bamboo versions 6.4.0 Description The issue arises from Bamboo's failure to properly check if a configured Mercurial repository URI contains values that the Windows operating system may consider argument...

Slack Technologies Slack URI Parsing Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Slack Technologies Slack. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...