CVE-2017-16006

Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of data: URIs in links and can therefore execute javascript...

CVE-2017-16006

Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of data: URIs in links and can therefore execute javascript...

CVE-2017-16006

Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of data: URIs in links and can therefore execute javascript...

Cross site scripting

SAP Internet Transaction Server ITS 6200.X.X has Reflected Cross Site Scripting XSS via certain wgate URIs. NOTE: the vendor has reportedly indicated that there will not be any further releases of this product...

CVE-2018-11415

SAP Internet Transaction Server ITS 6200.X.X has Reflected Cross Site Scripting XSS via certain wgate URIs. NOTE: the vendor has reportedly indicated that there will not be any further releases of this product...

CVE-2018-11415

Summary of CVE-2018-11415 and public details : SAP ITS 6200.X.X is reported to be vulnerable to a reflected Cross-Site Scripting (XSS) flaw triggered via certain wgate URIs. Multiple connected sources confirm an XSS scenario in the SAP Internet Transaction Server 6200.X.X, with references indicat...

CVE-2018-11415

SAP Internet Transaction Server ITS 6200.X.X has Reflected Cross Site Scripting XSS via certain wgate URIs. NOTE: the vendor has reportedly indicated that there will not be any further releases of this product...

Design/Logic Flaw

LiteCart before 2.1.2 allows remote attackers to cause a denial of service memory consumption via URIs that do not exist, because publichtml/logs/notfound.log grows without bound, and is loaded into memory for each request...

CVE-2018-10827

CVE-2018-10827 affects LiteCart prior to 2.1.2. The vulnerability arises when a non-existent URI is requested, causing public_html/logs/not_found.log to grow without bound and be loaded into memory for each request, leading to memory consumption and potential denial of service. Public sources des...

CVE-2018-10827

LiteCart before 2.1.2 allows remote attackers to cause a denial of service memory consumption via URIs that do not exist, because publichtml/logs/notfound.log grows without bound, and is loaded into memory for each request...

Directory traversal

An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, as demonstrated by URIs beginning with index.php?xiwindow=./ and config/?xiwindow=../ substrings...

CVE-2018-8065

An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access violation on the syncbrs.exe memory region that can be triggered by rapidly sending a variety of HTTP requests with long HTTP header values or long URIs...

Marked vulnerable to XSS from data URIs

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...

Python 'Lib/webbrowser.py' Remote Command Execution Vulnerability

Python is an object-oriented, straightforward computer programming language. A remote command execution vulnerability exists in Python 'Lib/webbrowser.py', which allows remote attackers to exploit the vulnerability to construct malicious URIs and inject arbitrary code...

GHSA-Q4QQ-FM7Q-CWP5 Multiple XSS Filter Bypasses in validator

Versions of validator prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the blacklist-based filter. Proof of Concept Various inputs that could bypass the filter were discovered: Improper parsing of nested tags: This is a test Incomplete...

Digium Asterisk non-SIP URIs Denial-of-Service (CVE-2017-14098)

A denial-of-service vulnerability exists in Digium Asterisk. The vulnerability is due to improper handling of non-SIP URIs within the sanitizetdata function. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted SIP packets to an Asterisk server...

Design/Logic Flaw

Apache Atlas versions 0.6.0 incubating, 0.7.0 incubating, and 0.7.1 incubating allow access to the webapp directory contents by pointing to URIs like /js and /img...

ownCloud cross-site scripting vulnerability (CNVD-2017-16363)

ownCloud is the open source file synchronization and sharing solution. A cross-site scripting vulnerability exists in ownCloud, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions,...

Sitecore CMS Cross-Site Scripting Vulnerability

Sitecore CMS is a content management system. A cross-site scripting vulnerability exists in Sitecore Experience Platform '/sitecore/client/Applications/List Manager/Taskpages/Contact list'. This allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform...

XSS in Data URI

Overview Affected versions of remarkable are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of data: URIs in links, and can therefore execute javascript. Proof of Concept link Recommendation Update to v1.7.0 or later References - Issue 227 - GitHub Advisory...