10680 matches found
CVE-2018-16551
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit...
CVE-2018-16551
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit...
CVE-2018-16551
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit...
CVE-2018-16551
CVE-2018-16551 affects LavaLite 5.5 and describes a cross-site scripting (XSS) vulnerability in the /edit URI, demonstrated by examples such as client/job/job/Zy8PWBekrJ/edit. The connected documents confirm the vulnerable component and the entry point, but do not provide concrete details on the ...
mozilla -- multiple vulnerabilities
Mozilla Foundation reports: CVE-2018-12377: Use-after-free in refresh driver timers CVE-2018-12378: Use-after-free in IndexedDB CVE-2018-12379: Out-of-bounds write with malicious MAR file CVE-2017-16541: Proxy bypass using automount and autofs CVE-2018-12381: Dragging and dropping Outlook email...
Samsung Email Information Disclosure Vulnerability
Samsung Email is an application from Samsung South Korea for sending, receiving and managing e-mail. An information disclosure vulnerability exists in the handling of file:/// URIs in Samsung Email, which stems from the program failing to properly validate user-submitted data. A local attacker...
Design/Logic Flaw
An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example, this can update the Web/Tpl/default/head.html file...
Directory traversal
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI...
Design/Logic Flaw
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2018-11616
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2018-11616
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Cross site scripting
Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI...
Directory traversal
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI...
CVE-2018-16134
CVE-2018-16134 affects CyBroHttpServer v1.0.3 by Cybrotech. The vulnerability is a reflected XSS via a crafted URI, enabling script injection in the server response. Public PoCs/exploits exist (e.g., Exploit-DB, PacketStorm) showing a simple payload. CVSS scores in the records: CVSSv2 base 4.3 (...
Supreme Directory Theme <= 1.1.8 - Unauthenticated Cross-Site Scripting (XSS)
This theme has a parameter, s, that allows execute a xss payload: " 1. Install the theme 2. Access the web on another browser 3. Write this uri: website.com/?s="alert0...
Supreme Directory Theme <= 1.1.8 - Unauthenticated Cross-Site Scripting (XSS)
This theme has a parameter, s, that allows execute a xss payload: " PoC 1. Install the theme 2. Access the web on another browser 3. Write this uri: website.com/?s="...
CVE-2018-11511
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'albumid' or 'scope' parameter via a photo-gallery/api/album/treelists/ URI...
CVE-2018-15138
Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs...
EKFiddle - A Framework Based On The Fiddler Web Debugger To Study Exploit Kits, Malvertising And Malicious Traffic In General
A framework based on the Fiddler web debugger to study Exploit Kits, malvertising and malicious traffic in general. Installation Download and install the latest version of Fiddler https://www.telerik.com/fiddler Special instructions for Linux and Mac here:...