13585 matches found
PT-2015-7604
Name of the Vulnerable Software and Affected Versions JosephErnest Void versions prior to 2015-10-02 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted URI. This occurs in the index.php file. Recommendations For versions prior...
Shopify: CSV Excel Macro Injection Vulnerability in export list of current users - app.shopify.com
Hi , I have found that when a user tries to Export list of current users who installed his apps through: https://app.shopify.com/services/partners/apiclients//exportinstalledusers the fields of the CSV file are not properly escaped. which makes them vulnerable to CSV Excel Macro Injection...
SolarWinds DameWare Mini Remote Control < 12.0 Hotfix 1 DWRCC.exe RCE
The remote host is running a version of SolarWinds DameWare Mini Remote Control prior to 12.0 Hotfix 1. It is, therefore, affected by a remote code execution vulnerability due to a flaw in the DWRCC.exe URI handler that is triggered when handling certain command line arguments. An unauthenticated...
CVE-2015-8220
Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a crafted commandline argument in a link...
Stack overflow
Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a crafted commandline argument in a link...
Android Browser应用程序拒绝服务漏洞
Android 4.0.3浏览器应用不正确处理特殊的URI，允许攻击者在IFRAME元素SRC属性中使用特制的market: URI并诱使应用程序解析，可使应用程序崩溃。 测试方法 var mframe = ""; forvar i = 0; i...
CVE-2015-8220: Improper Restriction of Operations within the Bounds of a Memory Buffer
Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a crafted commandline argument in a link...
Multiple Huawei Product Catalog Traversal Vulnerabilities
The Huawei HG532e, HG532n and HG532s are wireless router products from Huawei China. A directory traversal vulnerability exists in multiple Huawei products. A remote attacker can leverage the directory traversal character '...' in the icon/ URI to read arbitrary files. This vulnerability can be...
Mail.ru: [maps.me] Reflected XSS
Browser-specific reflected XSS via URI parameters in maps.me project. maps.me is not currently in bug bounty scope...
Directory traversal
Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. dot dot in an icon/ URI...
CVE-2015-7254
The Huawei HG532e , HG532n , and HG532s wireless routers are vulnerable to a path traversal vulnerability (CWE-22) because the software does not properly validate HTTP requests on a specific port. A remote, unauthenticated attacker can exploit this by crafting a request to the /icon/ URI using .....
Mail.ru: [id.my.com] Reflected XSS
Browser-specific reflected XSS via URI parameters in id.my.com. id.my.com is not covered by bug bounty scope...
Reading sensitive profile files through local HTML file on Android — Mozilla
Security researcher Jordi Chancel reported an issue in Firefox for Android where a locally saved HTML file could use file: URIs to trigger the download of additional files or opening of cached profile data without user awareness...
Mail.ru: [lucky-fields.my.com] Reflected XSS
Browser-specific reflected XSS via URI parameters in lucky-fields.my.com. lucky-fields.my.com is not covered by bug bounty scope...
Mail.ru: [mg.my.com] Reflected XSS
Browser-specific reflected XSS via URI parameters in mg.my.com. mg.my.com is not covered by bug bounty scope...
Mail.ru: [games.my.com] Reflected XSS
Browser-specific reflected XSS via URI parameters in games.my.com. games.my.com is not covered by bug bounty scope...
Mail.ru: [aw.my.com] Reflected XSS
Browser-specific reflected XSS via URI parameters in aw.my.com. aw.my.com is not covered by bug bounty scope...
CVE-2007-4038
Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which...