Security Bulletin: Cross-site scripting vulnerability in WebSphere Lombardi Edition redirect-login mechanism (CVE-2014-6101)

Summary WebSphere Lombardi Edition uses a mechanism to silently login users who have previously authenticated themselves. This mechanism is vulnerable to cross-site scripting attacks. Vulnerability Details CVE ID:CVE-2014-6101 DESCRIPTION: WebSphere Lombardi Edition is vulnerable to cross-site...

Path traversal

node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path...

PT-2018-6052 · Github · Uri.Js

Name of the Vulnerable Software and Affected Versions: uri-js versions 2.1.1 and earlier Description: The issue arises from a regular expression used by uri-js to validate URLs, which is vulnerable to redos. This vulnerability causes the program to hang and results in 100% CPU usage when attempti...

Amazon Linux 2 : ruby (ALAS-2018-983)

Path traversal when writing to a symlinked basedir outside of the root RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal...

DEBIAN-CVE-2018-10101

Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server...

CVE-2018-10101

Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server...

Code injection

Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server...

CVE-2018-10100

Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS...

CVE-2018-10101

Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server...

Joomla! Component JS Jobs 1.2.0 - Cross-Site Scripting

Joomla! Component JS Jobs 1.2.0 - Cross-Site Scripting Exploit Title: Joomla! Component JS Jobs 1.2.0 - Cross Site Scripting Google Dork: N/A Date: 03-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: https://www.joomsky.com/products/js-jobs.html...

elearn.eb.com XSS vulnerability

Open Bug Bounty ID: OBB-552767 Description| Value ---|--- Affected Website:| elearn.eb.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-6029

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...

CVE-2018-6029

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...

Server side request forgery (ssrf)

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...

CVE-2018-6029

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...

CVE-2018-6029

CVE-2018-6029 affects NoneCms 1.3.0. The vulnerability exists in the copy function of application/admin/controller/Article.php, where SSRF is possible because URL validation only checks for the substring "csdn". This allows remote attackers to access internal and external network resources. No ex...

CVE-2018-6029: Server-Side Request Forgery (SSRF)

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...

PT-2018-17308

Name of the Vulnerable Software and Affected Versions NoneCms version 1.3.0 Description The issue allows remote attackers to access internal and external network resources via Server Side Request Forgery SSRF due to inadequate URL validation in the copy function. Specifically, the validation only...

Automattic: Remote Code Execution in Wordpress Desktop

An attacker can create a malicious page that when viewed or edited in Wordpress Desktop App will results in remote code execution. This issue looks to be around this line of code: https://github.com/Automattic/wp-desktop/blob/develop/desktop/window-handlers/external-links/index.jsL38 If...

CVE-2017-15308

Huawei iReader app before 8.0.2.301 has an input validation vulnerability due to insufficient validation on the URL used for loading network data. An attacker can control app access and load malicious websites created by the attacker, and the code in webpages would be loaded and run...