PT-2017-13728

Name of the Vulnerable Software and Affected Versions Red Lion HMI panels version HMI 2.41 PLC 2.42 Description The issue allows remote attackers to cause a denial of service, resulting in a software exception. This can be achieved by sending an HTTP POST request to a long URI that does not exist...

CVE-2017-15886

Server-side request forgery SSRF vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI...

CVE-2017-15886

Server-side request forgery SSRF vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI...

CVE-2017-17894

Readymade Job Site Script has CSRF via the /job URI...

CVE-2017-17896

Readymade Job Site Script has XSS via the keyword parameter to the /job URI...

CVE-2017-17874

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

CVE-2017-17873

Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATHINFO to the /p URI...

CVE-2017-17848

An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be...

Cross site request forgery (csrf)

Readymade Job Site Script has CSRF via the /job URI...

Code injection

An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be...

CVE-2017-17896: Improper Neutralization of Input During Web Page Generation

Readymade Job Site Script has XSS via the keyword parameter to the /job URI...

CVE-2017-17848: Improper Verification of Cryptographic Signature

An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be...

CVE-2017-17873: Improper Neutralization of Special Elements used in an SQL Command

Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATHINFO to the /p URI...

PHP Scripts Mall Readymade Job Site Script Cross Site Request Forgery Vulnerability

PHP Scripts Mall Readymade Job Site Script is a PHP based job site script by PHP Scripts Mall India. The script includes features like job management, profile management and email notifications. A cross-site request forgery vulnerability exists in PHP Scripts Mall Readymade Job Site Script. A...

CVE-2017-17895

Readymade Job Site Script has SQL Injection via the locationname array parameter to the /job URI...

CVE-2017-17894

Readymade Job Site Script has CSRF via the /job URI...

CVE-2017-17894

CVE-2017-17894 affects the Readymade Job Site Script, with a CSRF flaw exploitable via the /job URI. Public sources (NVD/NVD-derived records) assign a CVSS‑3 base score of 8.8 (HIGH) and CVSS‑2 of 6.8 (MEDIUM), indicating network access required with user interaction typically needed (UI: REQUIRE...

CVE-2017-17896

Readymade Job Site Script has XSS via the keyword parameter to the /job URI...

PT-2017-15063

Name of the Vulnerable Software and Affected Versions Vanguard Marketplace Digital Products PHP version 1.4 Description The issue allows for arbitrary file upload through actions such as "Add a new product" or "Add a product preview". This can result in a .php file being made accessible under a...