13585 matches found
CVE-2017-9332
The smartyself function in modules/modulesmarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the self Smarty tag...
PT-2017-18848
Name of the Vulnerable Software and Affected Versions PivotX version 2.3.11 Description The issue concerns the smarty self function in PivotX, which mishandles the URI. This allows for cross-site scripting XSS attacks via vectors involving quotes in the self Smarty tag. Recommendations For PivotX...
Trend Micro IWSVA ReportHandler DoCmd Command Injection
An authentication bypass vulnerability has been reported in HPE Intelligent Management Center. The vulnerability is due to errors in handling specific strings contained in the request URI. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted request to the target...
CVE-2017-9292
Lansweeper before 6.0.0.65 has XSS in an image retrieval URI, aka Bug 542782...
CVE-2017-9292
Lansweeper before 6.0.0.65 has XSS in an image retrieval URI, aka Bug 542782...
PT-2017-18825
Name of the Vulnerable Software and Affected Versions Lansweeper versions prior to 6.0.0.65 Description The issue is related to an image retrieval URI. It involves a cross-site scripting XSS problem. Recommendations For versions prior to 6.0.0.65, update to version 6.0.0.65 or later to resolve th...
CVE-2017-9292: Improper Neutralization of Input During Web Page Generation
Lansweeper before 6.0.0.65 has XSS in an image retrieval URI, aka Bug 542782...
DEBIAN-CVE-2014-0225
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack...
CVE-2014-0225
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack...
CVE-2014-0225: Improper Restriction of XML External Entity Reference
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack...
Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2017-08082)
RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in the program/include/rcmail.php file in version 1.1.x prior to Roundcube Webmail 1.1.2. A remote attacker c...
B. Braun SpaceCom Module Open Redirect Vulnerability
The B. Braun SpaceCom Module is a product designed to facilitate the exchange of information in healthcare systems by connecting hospital network systems to external clinical systems, entering data, medical history, service information, etc. to connected workstations. B. An open redirection...
CVE-2015-5381
Cross-site scripting XSS vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the mbox parameter to the default URI...
PT-2017-6848
Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.1.x before 1.1.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the mbox parameter to the default URI. This could potentially lead to unauthorized...
HTTrack v3.x - Stack Buffer Overflow Vulnerability
Document Title: =============== HTTrack v3.x - Stack Buffer Overflow Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2068 Release Date: ============= 2017-05-22 Vulnerability Laboratory ID VL-ID: ==================================== 2068...
Microsoft OneDrive iOS App 8.13 Insecure URI Scheme Handling Vulnerability
Microsoft OneDrive iOS App version 8.13 suffers from insecure handling of URI schemes A short demo video is available here: https://youtu.be/0jZdM9peVSk SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Insecure Handling...
Microsoft OneDrive iOS App 8.13 Insecure URI Scheme Handling
A short demo video is available here: https://youtu.be/0jZdM9peVSk SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Insecure Handling Of URI Schemes product: Microsoft OneDrive iOS App vulnerable version: 8.13 fixed...
PT-2018-8250
Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 53 Description: The issue involves a mechanism to spoof the Firefox for Android address bar using a "javascript:" URI. This occurs because the base domain is parsed incorrectly on Firefox for Android, resulting in th...
Command Injection (CVE-2017-8768)
SourceTree for Mac is affected by a command injection vulnerability in URI handling. The vulnerability can be triggered through a browser or the SourceTree interface. Affected versions: Versions of SourceTree for Mac starting with 1.4.0 before version 2.5.1 are affected by this vulnerability. Fix...
Command Injection (CVE-2017-8768)
SourceTree for Mac is affected by a command injection vulnerability in URI handling. The vulnerability can be triggered through a browser or the SourceTree interface. Affected versions: Versions of SourceTree for Mac starting with 1.4.0 before version 2.5.1 are affected by this vulnerability. Fix...