CVE-2017-17553: Undefined Security Weakness

The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser...

CVE-2017-17553

The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser...

Cisco WebEx Network Recording Player Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco WebEx Network Recording Player. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wbx URI handler. When parsing the register parameter, the...

Cisco Meeting Server Denial of Service Vulnerability

A vulnerability in Cisco Meeting Server versions prior to 2.2.2 could allow an authenticated, remote attacker to cause the system to reload, resulting in a denial of service DoS condition. The vulnerability is due to video calls being made on systems with a particular configuration. An attacker...

CVE-2017-16956

b3log Symphony aka Sym 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title...

Cross site scripting

b3log Symphony aka Sym 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title...

CVE-2017-16956

b3log Symphony aka Sym 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title...

CVE-2017-16956: Improper Neutralization of Input During Web Page Generation

b3log Symphony aka Sym 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title...

Authentication flaw

An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving unhashed tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allow...

dayrui FineCms Cross-Site Request Forgery Vulnerability

dayrui FineCms is China Tianrui dayrui program design team released a set of content management system CMS using MVC architecture and PDO database interface development. A cross-site request forgery vulnerability exists in version 5.2.0 of dayrui FineCms before 2017.11.16. A remote attacker can...

CVE-2017-16894

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in...

CVE-2017-16894

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in...

CVE-2017-16894

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in...

CVE-2017-16894

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in...

thoughtbot Paperclip ruby gem server-side request forgery vulnerability

The thoughtbot Paperclip ruby gem is an open source Ruby-based file attachment manager from thoughtbot, USA. A server-side request forgery vulnerability exists in the Paperclip::UriAdapter class in the thoughtbot Paperclip ruby gem 3.1.4 and later versions. An attacker can exploit this...

[20180103] - Core - XSS vulnerability in Uri class

Inadequate input filtering in the Uri class formerly JUri leads to a XSS vulnerability...

CVE-2017-16866

dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting XSS in core/MController.php via the DRURI field...

PT-2017-14603

Name of the Vulnerable Software and Affected Versions dayrui FineCms versions 5.2.0 before 2017.11.16 Description The issue concerns a Cross Site Scripting XSS problem. It is located in the core/M Controller.php file via the DR URI field. Recommendations For dayrui FineCms versions 5.2.0 before...

[SECURITY] Fedora 26 Update: apr-util-1.5.4-6.fc26

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more...

Server-Side Request Forgery (SSRF)

paperclip is vulnerable to server-side request forgery SSRF attacks. The application automatically loads URLs passed to the URI adapter, allowing a malicious user to pass malicious URLs to the application to gain access to sensitive information such as server configuration...