10675 matches found
CVE-2019-17213
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header...
Design/Logic Flaw
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header...
Authentication flaw
The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI...
CVE-2019-17213
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header...
CVE-2019-17213
CVE-2019-17213 affects the WebARX plugin for WordPress (version 1.3.0). The connected records confirm an unauthenticated stored cross-site scripting (XSS) vulnerability that can be triggered via the URI or the X-Forwarded-For HTTP header. The root cause is an XSS flaw in how input in the request ...
CVE-2019-17214
The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI...
ParantezTeknoloji Library Software 16.0519000 Open Redirection
Exploit Title : ParantezTeknoloji Library Software 16.0519000 Open Redirection Vulnerability Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/10/2019 Vendor Homepage : parantezteknoloji.com.tr Software Affected Versions and Download Links : Koha 3.2000000...
CVE-2009-3896
src/http/ngxhttpparse.c in nginx aka Engine X 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service NULL pointer dereference and worker process crash via a long URI...
CVE-2008-1467
CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URI, related to "received URLs in the message window." NOTE: this issue has been disputed due to the user-assisted nature, since the URL must be selected and launched by t...
CVE-2007-6672
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' slash characters in the URI...
CVE-2008-5660
Format string vulnerability in the vinagreutilsshowerror function src/vinagre-utils.c in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response...
ZmartZone 'mod_auth_openidc' Module Open Redirection Vulnerability
Description ZmartZone modauthopenidc Module is prone to an open-redirection vulnerability. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this...
Multiple Cisco Unified Communications Products Cross Site Request Forgery Vulnerability
Description Multiple Cisco Unified Communications Products are prone to a cross-site request-forgery vulnerability because the application does not properly validate HTTP requests. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the...
WebKit - UXSS Using JavaScript: URI and Synchronous Page Loads
WebKit - UXSS Using JavaScript: URI and Synchronous Page Loads VULNERABILITY DETAILS void DocumentWriter::replaceDocumentconst String& source, Document ownerDocument ... beginmframe-document-url, true, ownerDocument; // 1 // begin might fire an unload event, which will result in a situation where...
WebKit - UXSS Using JavaScript: URI and Synchronous Page Loads
VULNERABILITY DETAILS void DocumentWriter::replaceDocumentconst String& source, Document ownerDocument ... beginmframe-document-url, true, ownerDocument; // 1 // begin might fire an unload event, which will result in a situation where no new document has been attached, // and the old document has...
WebKit - UXSS Using JavaScript: URI and Synchronous Page Loads Exploit
VULNERABILITY DETAILS void DocumentWriter::replaceDocumentconst String& source, Document ownerDocument ... beginmframe-document-url, true, ownerDocument; // 1 // begin might fire an unload event, which will result in a situation where no new document has been attached, // and the old document has...
CVE-2019-16999
CloudBoot through 2019-03-08 allows SQL Injection via a crafted Status field in JSON data to the api/osinstall/v1/device/getNumByStatus URI...
CVE-2019-16414
A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI...