13585 matches found
rack-ssl Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack...
GHSA-333X-9VGQ-V2J4 Directory Traversal in geddy
Versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack via URI encoded attack vectors. Proof of Concept http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd Recommendation Update geddy to version = 13.0.8...
Moderate severity vulnerability that affects validator
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via a crafted javascript URI...
CVE-2017-15687
DOM Based Cross Site Scripting XSS exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI...
CVE-2017-15380
XSS exists in the E-Sic 1.0 /cadastro/index.php URI aka the requester's registration area via the nome parameter...
CVE-2017-15687
DOM Based Cross Site Scripting XSS exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI...
CVE-2017-15379
An authentication bypass exists in the E-Sic 1.0 /index aka login URI via '=''or' values for the username and password...
Authentication flaw
An authentication bypass exists in the E-Sic 1.0 /index aka login URI via '=''or' values for the username and password...
CVE-2017-15379
An authentication bypass exists in the E-Sic 1.0 /index aka login URI via '=''or' values for the username and password...
CVE-2017-15687
DOM Based Cross Site Scripting XSS exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI...
PT-2017-14146
Name of the Vulnerable Software and Affected Versions Logitech Media Server versions 7.7.1 through 7.7.6, 7.9.0, 7.9.1 Description A DOM Based Cross Site Scripting XSS issue exists, which can be exploited via a crafted URI. Recommendations For versions 7.7.1 through 7.7.6, 7.9.0, 7.9.1, at the...
CVE-2017-15687: Improper Neutralization of Input During Web Page Generation
DOM Based Cross Site Scripting XSS exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI...
WePay: [stage-go.wepay.com] XSS via Request URI
PoC Open URL in Internet Explorer. This vulnerability only works in Internet Explorer and possibly in Edge, since it is necessary to send a Request-URI without a URL Encode, which is only possible in this browser via redirect...
Mac OS X 10.12 isolation mechanism bypass vulnerability
Vulnerability summary Mac OS X a vulnerability exists that could allow an attacker to bypass the Apple of the isolation mechanism, without any restrictions to execute arbitrary JavaScript code. Vulnerability submitter From WeAreSegment security researcher Filippo Cavallarin to Beyond Security SSD...
CVE-2017-5791
The doFilter method in UrlAccessController in HPE Intelligent Management Center iMC PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI...
CVE-2017-15287: Improper Neutralization of Input During Web Page Generation
There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bouquets" field, or the file parameter to the /file URI...
Authentication flaw
The doFilter method in UrlAccessController in HPE Intelligent Management Center iMC PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI...
CVE-2017-5791
The doFilter method in UrlAccessController in HPE Intelligent Management Center iMC PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI...
CVE-2017-15220
Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginning with a /../ substring. This allows remote attackers to execute arbitrary code...