uri-js denial of service vulnerability

uri-js is a JavaScript library for parsing and validating URLs. A security vulnerability exists in the regular expressions used in uri-js 2.1.1 and earlier versions. An attacker can exploit the vulnerability to cause the program to hang and cause CPU usage to reach 100%...

CVE-2018-12432

JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...

Design/Logic Flaw

JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...

CVE-2018-12432

JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...

CVE-2018-12432

JavaMelody up to version 1.60.0 is vulnerable to XSS via the counter parameter in the clear_counter action at the /monitoring URI. The root cause is unsanitized input in the counter parameter, enabling attacker-controlled script injection. Documented affected component: javamelody-core (JavaMelod...

CVE-2018-12432

JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...

Ximdex cross-site scripting vulnerability (CNVD-2018-14422)

Ximdex is a content and data management system. The system includes features such as an intelligent search engine, information aggregation, image and text recognition, etc. The DMS component is one of the data management components. A cross-site scripting vulnerability exists in the /edit URI of...

Cross site scripting

The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter...

CVE-2018-12273

The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter...

CVE-2018-12263

portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI...

CVE-2018-12263

The CVE-2018-12263 entry affects portfolioCMS 1.0.5, with a vulnerability in the admin/portfolio.php?newpage=true URI that allows uploading arbitrary .php files. The connected CNVD/NVD/OSV records confirm this behavior, citing a file-upload vulnerability in portfolioCMS 1.0.5. The underlying root...

CVE-2018-12263

portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI...

Mail.ru: Stealing Arbitrary Private Files of MyMail App

It was possible for local malware application to steal sensitive local files of MyMail / Mail.Ru Mail application due to specifics of file:// schema URI handling in SharingActivity...

jira.unite.un.org XSS vulnerability

Open Bug Bounty ID: OBB-630879 Description| Value ---|--- Affected Website:| jira.unite.un.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Tencent Foxmail URI parsing Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing o...

CVE-2017-5450

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorrectly, making the resulting location less visibly a spoofed site and showing an incorrect domain in appended notifications. This vulnerability affects Firefox...

CVE-2017-5450

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorrectly, making the resulting location less visibly a spoofed site and showing an incorrect domain in appended notifications. This vulnerability affects Firefox...

Design/Logic Flaw

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorrectly, making the resulting location less visibly a spoofed site and showing an incorrect domain in appended notifications. This vulnerability affects Firefox...

CVE-2017-5450

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorrectly, making the resulting location less visibly a spoofed site and showing an incorrect domain in appended notifications. This vulnerability affects Firefox...

CVE-2017-5450

CVE-2017-5450 describes a spoofing vulnerability in Firefox for Android where the address bar can be spoofed via a javascript: URI due to incorrect parsing of the base URL. Affected: Firefox for Android versions