CVE-2018-19311

Centreon 3.4.x fixed in Centreon 18.10.0 allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring Status Details Services" screen...

CVE-2018-19311

Centreon 3.4.x is vulnerable to a cross-site scripting (XSS) flaw triggered via the Service field when accessing main.php?p=20201 (e.g., in Monitoring > Status Details > Services). The issue is fixed in Centreon 18.10.0. Affected component: the web UI Service field handling; root cause info...

CVE-2018-19291

An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...

DiliCMS Cross-Site Request Forgery Vulnerability

DiliCMS is a rapid development content management system based on CodeIgniter. DiliCMS 2.4.0 suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to delete a user or group via the admin/index.php/user/del/1 or admin/index.php/role/del/2 URIs...

uriparser UriCommon.c File Denial of Service Vulnerability

uriparser is a standard based on RFC 3986 URI parsing and processing library . A security vulnerability exists in the UriCommon.c file in uriparser versions prior to 0.9.0. An attacker can exploit this vulnerability to cause a denial of service with the 'uriResetUri' function...

uriparser integer overflow vulnerability

uriparser is a standard based on RFC 3986 URI parsing and processing library . A security vulnerability exists in the UriQuery.c file in uriparser version 0.9.0. An attacker can exploit this vulnerability to cause an integer overflow with the help of the 'uriComposeQuery' or 'uriComposeQueryEx'...

The vulnerability of the Omnibox component in the Chrome web browser allows a hacker to replace the URI address.

The vulnerability of the Omnibox component in the Chrome web browser is related to information representation errors in the user interface. Exploiting this vulnerability could allow an attacker to replace the displayed URI address...

CVE-2018-19220

An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI...

UBUNTU-CVE-2018-19199

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery or uriComposeQueryEx function because of an unchecked multiplication...

DEBIAN-CVE-2018-19199

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery or uriComposeQueryEx function because of an unchecked multiplication...

DEBIAN-CVE-2018-19200

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri function...

XSS in Data URI in remarkable

Affected versions of remarkable are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of data: URIs in links, and can therefore execute javascript. Proof of Concept markdown link Recommendation Update to v1.7.0 or later...

GHSA-MRMF-QWXG-7C3H XSS in Data URI in remarkable

Affected versions of remarkable are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of data: URIs in links, and can therefore execute javascript. Proof of Concept markdown link Recommendation Update to v1.7.0 or later...

D-LINK Central WifiManager (CWM 100) 1.03 r0098 Server-Side Request Forgery Vulnerability

Using a web browser or script server-side request forgery SSRF can be initiated against internal/external systems to conduct port scans by leveraging D-LINK's MailConnect component. The MailConnect feature on D-Link Central WiFiManager CWM-100 version 1.03 r0098 devices is intended to check a...

Directory Traversal

Jetty utilities are vulnerable to directory traversal. The vulnerability is due to the lack of checking directory traversal sequences in the URI...

CVE-2018-19092

An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie...

CVE-2018-18963

Busca.aspx.cs in Degrau Publicidade e Internet Plataforma de E-commerce allows SQL Injection via the busca/ URI...

CVE-2018-18963

Busca.aspx.cs in Degrau Publicidade e Internet Plataforma de E-commerce allows SQL Injection via the busca/ URI...

Design/Logic Flaw

JEECMS 9.3 has XSS via an index.do/content/update?type=update URI...

CVE-2018-18935

An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=component&act=addnew URI, as demonstrated by adding a level=1 account...