10680 matches found
Cross site scripting
An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMSMain.php URI...
Cross site request forgery (csrf)
A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMSUser.php?Class=add&CF=user URI...
CVE-2018-18744
An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMSMain.php URI...
CVE-2018-18744
CVE-2018-18744 describes a cross-site scripting (XSS) vulnerability in SEMCMS 3.4 . The issue is exploitable via the fifth text box in the path to the URI admin/SEMCMS_Main.php , enabling an attacker to inject arbitrary script/HTML. The provided data cites an XSS impact with low to medium severit...
CVE-2018-18743
An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMSCategories.php?pid=1&lgid=1 URI...
GHSA-XJRR-XV9M-4PW5 Improper Input Validation in alilibaba:fastjson
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...
UBUNTU-CVE-2018-12401
Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This could lead to denial of service DOS attacks. This vulnerability affects Firefox 63...
php imap_open Remote Code Execution
The imapopen function within php, if called without the /norsh flag, will attempt to preauthenticate an IMAP session. On Debian based systems, including Ubuntu, rsh is mapped to the ssh binary. Ssh's ProxyCommand option can be passed from imapopen to execute arbitrary commands. While many custom...
Improper Input Validation
Fastjson allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java...
Code injection
TP-Link TL-SC3130 1.6.18P12121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI...
CVE-2018-18428
TP-Link TL-SC3130 1.6.18P12121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI...
CVE-2018-18420
Cross-Site Request Forgery CSRF vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenariocontent%2Fpanels%2Fcontent URI...
CVE-2018-18416
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the sitename parameter to the admin/settings/update URI...
CVE-2018-18420
Zenario Content Management System 8.3 is affected by a Cross-Site Request Forgery (CSRF) vulnerability via admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent. The issue arises from lack of request authenticity verification, enabling an attacker to submit requests on behalf of a log...
CVE-2018-18417
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...
Sql injection
ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI...
CVE-2018-12382
The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before the loaded domain name, scrolling the loaded domain out of view to the right. This can lead to user confusion. This vulnerability only affects Firefox for...
GHSA-4R64-WF76-C53P In blynk-server a Directory Traversal exists
In blynk-server in Blynk before 0.39.7, Directory Traversal exists via a ../ in a URI that has /static or /static/js at the beginning, as demonstrated by reading the /etc/passwd file...
GHSA-5Q99-F34M-67GC Apache Tomcat Open Redirect vulnerability
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory e.g. redirecting to '/foo/' when the user requested '/foo' a specially crafted URL could be used to cause the redirect to be generated to any URI of the...