CVE-2018-5544

When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages pages with a logon agent or a confirm box, the BIG-IP APM may disclose configuration information such as partition and agent names via URI parameters...

CVE-2018-5544

CVE-2018-5544 affects F5 BIG-IP APM rendering pages with a logon agent or confirm box, potentially disclosing configuration details (partition/agent names) via URI parameters. Affected: BIG-IP APM 13.0.0–13.1.1 (also 12.1.0–12.1.3 per advisory table). 12.x is not vulnerable per the table; 14.x fi...

Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection

Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection Exploit Title: Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection Date: 2018-07-20 Software Link: https://github.com/nystudio107/craft-seomatic Exploit Author: Sebastian Kriesten 0xB455 Contact:...

Insufficient URI encoding in restforce

A flaw in how restforce constructs URL's may allow an attacker to inject additional parameters into Salesforce API requests. Impact ------ This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods...

Code injection

wancms 1.0 through 5.0 allows remote attackers to cause a denial of service resource consumption via a checkcode aka verification code URI in which the values of fontsize, width, and height are large numbers...

CVE-2018-14596

wancms 1.0 through 5.0 allows remote attackers to cause a denial of service resource consumption via a checkcode aka verification code URI in which the values of fontsize, width, and height are large numbers...

CVE-2018-14596

wancms 1.0 through 5.0 allows remote attackers to cause a denial of service resource consumption via a checkcode aka verification code URI in which the values of fontsize, width, and height are large numbers...

CVE-2018-14596

wancms 1.0 through 5.0 allows remote attackers to cause a denial of service resource consumption via a checkcode aka verification code URI in which the values of fontsize, width, and height are large numbers...

GHSA-333W-RXJ3-F55R Regular Expression Denial Of Service in uri-js

Affected versions of uri-js is susceptible to a regular expression denial of service vulnerability when user input is sent to the .parse method. Recommendation Update to v3.0.0 or later...

Regular Expression Denial Of Service in uri-js

Affected versions of uri-js is susceptible to a regular expression denial of service vulnerability when user input is sent to the .parse method. Recommendation Update to v3.0.0 or later...

Vanilla: [allhiphop.vanillacommunities.com] XSS Request-URI

Summary: Reflected XSS via Request-URI for Internet Explorer. Steps to reproduce: 1. Open URL in Internet Explorer tested on IE 11 https://blackfan.ru/x?r=https://allhiphop.vanillacommunities.com/xxx%22-alertdocument.domain-%22xxx/%252e%252e/ blackfan.ru/x - a simple redirection script that is...

feedparser Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in feedparser.py in Universal Feed Parser aka feedparser or python-feedparser 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI...

Cross site scripting

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server"...

CVE-2018-14418

In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI...

Sql injection

In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI...

CVE-2018-14418

Summary: CVE-2018-14418 affects Msvod Cms v10 and is a SQL Injection vulnerability exploitable via the images/lists?cid= URI. The root cause is unsanitized input in the cid parameter, enabling arbitrary SQL commands. Public exploit content shows how payloads can retrieve database, user, and versi...

CVE-2018-14418

In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI...

Design/Logic Flaw

libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...

CVE-2018-14399

libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...

PT-2018-12490 · Phpcms · Phpcms

Name of the Vulnerable Software and Affected Versions: PHPCMS version 9.6.0 Description: The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved by sending a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the...