CVE-2017-16894

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in...

CVE-2017-16894

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in...

CVE-2017-16894

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in...

CVE-2017-16894

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in...

thoughtbot Paperclip ruby gem server-side request forgery vulnerability

The thoughtbot Paperclip ruby gem is an open source Ruby-based file attachment manager from thoughtbot, USA. A server-side request forgery vulnerability exists in the Paperclip::UriAdapter class in the thoughtbot Paperclip ruby gem 3.1.4 and later versions. An attacker can exploit this...

[20180103] - Core - XSS vulnerability in Uri class

Inadequate input filtering in the Uri class formerly JUri leads to a XSS vulnerability...

CVE-2017-16866

dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting XSS in core/MController.php via the DRURI field...

[SECURITY] Fedora 26 Update: apr-util-1.5.4-6.fc26

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more...

Server-Side Request Forgery (SSRF)

paperclip is vulnerable to server-side request forgery SSRF attacks. The application automatically loads URLs passed to the URI adapter, allowing a malicious user to pass malicious URLs to the application to gain access to sensitive information such as server configuration...

Recurly Client .NET Library Server-Side Request Forgery Attack Vulnerability

Recurly Client .NET Library is an API wrapper for Recurly from Recurly USA. A server-side request forgery attack vulnerability exists in Recurly Client .NET Library, which stems from the program failing to properly use the 'Uri.EscapeUriString' function. The vulnerability can be exploited by an...

Server side request forgery (ssrf)

The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources...

CVE-2017-16562

The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the upautolog parameter in the QUERYSTRING to the default URI...

PG All Share Video 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: PG All Share Video 1.0 - SQL Injection Vendor Homepage: http://www.pilotgroup.net/ Software Link: http://www.allsharevideo.com/features.php Demo: http://demo.allsharevideo.com/ Version: 1.0 Category: Webapps Tested on:...

CVE-2014-0073

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin org.apache.cordova.inappbrowser before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute...

Authentication flaw

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin org.apache.cordova.inappbrowser before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute...

Sql injection

Adult Script Pro 2.2.4 allows SQL Injection via the PATHINFO to a /download URI, a different vulnerability than CVE-2007-6576...

CVE-2017-15959

Adult Script Pro 2.2.4 allows SQL Injection via the PATHINFO to a /download URI, a different vulnerability than CVE-2007-6576...

Sql injection

Job Board Script Software allows SQL Injection via the PATHINFO to a /job-details URI...

CVE-2017-15964

Job Board Script Software allows SQL Injection via the PATHINFO to a /job-details URI...

CVE-2017-15959

CVE-2017-15959 affects Adult Script Pro 2.2.4 . The vulnerability is a SQL injection via the request path (PATH_INFO) to the /download URI, as described in multiple sources. The root cause is unsafely handling PATH_INFO leading to SQL command injection; the issue is reported as a separate vulnera...