Remote Code Execution (RCE)

php is vulnerable to remote code execution RCE attacks. The vulnerability exists through a format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information memory contents and possibly execute arbitrary cod...

CVE-2019-6267

CVE-2019-6267 concerns the WordPress plugin Premium WP Suite Easy Redirect Manager (version/build: 28.07-17) where an XSS flaw exists. The vulnerability arises from a crafted GET request that is mishandled during log viewing at the URI templates/admin/redirect-log.php, allowing arbitrary script H...

CVE-2019-6251

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge...

Code injection

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge...

CVE-2019-6251

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge...

CVE-2019-6251

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge...

CVE-2019-6251

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge...

CVE-2019-6251

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge...

CVE-2019-6251

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge...

Hootoo HT-05 - Remote Code Execution (Metasploit)

require 'msf/core' require 'net/http' require "uri" class MetasploitModule 'Hotoo HT-05 remote shell exploit', 'Description' = %q This module tries to open a door in the device by exploiting the RemoteCodeExecution by creating a backdoor inside the device This exploit was written by Andrei Manole...

CVE-2019-6243

CVE-2019-6243 affects Frog CMS 0.9.5 with a cross-site scripting (XSS) vulnerability exposed via the forgot password page (the /admin/?/login/forgot URI). The issue is confirmed across multiple sources (NVD entry and CNVD/CVEs references) and is limited to input handling on the forgot-password fl...

Apache Tomcat < 6.0.10 Directory Traversal

According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 6.0.10. It is, therefore, affected by the following vulnerability : - A directory traversal vulnerability exists in Tomcat due to improper handling of certain path delimiters when...

CVE-2018-20065

Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file...

CVE-2018-20065

Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file...

Design/Logic Flaw

Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file...

CVE-2018-20065

CVE-2018-20065 affects Google Chrome prior to 71.0.3578.80 via the PDFium component. The vulnerability arises from how Chrome handles URI actions in PDFs, allowing a remote attacker to trigger potentially unsafe navigations without user gesture through a crafted PDF file. Connected sources specif...

CVE-2018-20065

Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file...

Bleach URI Scheme Restriction Bypass

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized...

Fedora 28 : python-bleach (2018-994424b810)

Version 2.1.3 March 5th, 2018 ------------------------------- Security fixes - Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would...

Fedora 28 : php-zendframework-zend-diactoros (2018-4a606489ae)

1.8.4 - 2018-08-01 Added - Nothing. Changed - This release modifies how ServerRequestFactory marshals the request URI. In prior releases, we would attempt to inspect the X-Rewrite-Url and X-Original-Url headers, using their values, if present. These headers are issued by the ISAPIRewrite module f...