CVE-2018-7741

Eramba e1.0.6.033 has Reflected XSS in the Date Filter via the created parameter to the /crons URI...

CVE-2018-7741

CVE-2018-7741 affects Eramba e1.0.6.033 and is a Reflected XSS vulnerability in the Date Filter caused by the created parameter to the /crons URI. The connected records corroborate the issue across multiple sources (NVD, Red Hat, CNVD, CVE lists). The available documents specify the vulnerability...

CVE-2018-7753: Improper Input Validation

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized...

PT-2018-18251

Name of the Vulnerable Software and Affected Versions: Eramba version 1.0.6.033 Description: The issue is related to Reflected XSS in the Date Filter. This occurs via the created parameter to the "/crons" URI. Recommendations: For Eramba version 1.0.6.033, avoid using the created parameter in the...

CVE-2018-1169

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within t...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within t...

CVE-2018-1169

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within t...

CVE-2018-1169

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within t...

CVE-2018-1169: Improper Neutralization of Special Elements used in an OS Command

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within t...

AxxonSoft Axxon Next Directory Traversal

Title AxxonSoft Axxon Next - AxxonSoft Client Directory Traversal via an initial /css//..%2f substring in a URI. CVE-2018-7467 Vulnerability Type Directory Traversal via an initial /css//..%2f substring in a URI Vendor of Product AxxonSoft Client Affected Product Code Base Axxon Next Affected...

Directory traversal

AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI...

Design/Logic Flaw

lyadmin 1.x has XSS via the configWEBSITETITLE parameter to the /admin.php?s=/admin/config/groupsave.html URI...

CVE-2018-7467

AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI...

PT-2018-10751

Name of the Vulnerable Software and Affected Versions Amazon Music Player version 6.1.5.1213 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. T...

Amazon Music Player URI parsing Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processi...

CVE-2018-7467: Improper Limitation of a Pathname to a Restricted Directory

AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI...

CVE-2018-5716

An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by changing a field in the Web Request, can have access to files on the File System of the Server. By specifying a pathname in the POST parameter "lf" to the goform/editlfgetdata UR...

Doorkeeper gem has stored XSS on authorization consent view

Stored XSS on the OAuth Client's name will cause users being prompted for consent via the "implicit" grant type to execute the XSS payload. The XSS attack could gain access to the user's active session, resulting in account compromise. Any user is susceptible if they click the authorization link...

CVE-2018-7251

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred...

CVE-2018-7251

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred...