CVE-2017-1000442

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...

Design/Logic Flaw

In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar - New Event" action...

CVE-2017-16906

In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar - New Event" action...

UBUNTU-CVE-2017-16906

In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar - New Event" action...

CVE-2017-16906

In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar - New Event" action...

CVE-2017-16906

CVE-2017-16906 affects Horde Groupware, specifically version 5.2.19–5.2.22, where an XSS vulnerability exists in the Calendar → New Event URL field. The vulnerability allows an attacker to inject HTML/JavaScript through the URL parameter, with potential for remote code execution as per CNVD descr...

CVE-2017-16906

In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar - New Event" action...

Cross-site Scripting

dolibarr is vulnerable to cross-site scripting attacks. The attack exists because it does not correctly filter the "url" field through the external calendar or 2 the bank name field in the "import external calendar" page, allowing the attacker to inject arbitrary script through them...

CVE-2016-2153

Cross-site scripting XSS vulnerability in the advanced-search feature in moddata in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted field in a URL, as...

i.FTP 2.21 - Host Address URL Field (SEH)

i.FTP 2.21 - Host Address URL Field SEH !/usr/bin/python Exploit Title: i.FTP 2.21 Host Address / URL Field SEH Exploit Date: 3-5-2016 Exploit Author: Tantaryu MING Vendor Homepage: http://www.memecode.com/iftp.php Software Link: http://www.memecode.com/data/iftp-win32-v2.21.exe Version: 2.21...

WordPress Plugin Import CSV 1.0 - Directory Traversal

WordPress Plugin Import CSV 1.0 - Directory Traversal Exploit Title: Wordpress Import CSV | Directory Traversal Exploit Author: Wadeek Website Author: https://github.com/Wad-Deek Software Link: https://downloads.wordpress.org/plugin/xml-and-csv-import-in-article-content.zip Stable Tag: 1.1 Tested...

AccessDiver 4.301 - Buffer Overflow

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ACCESSDIVER-BUFFER-OVERFLOW.txt Vendor: ============== M. Jean Fages www.accessdiver.com circa 1998-2006 Product: ============================= AccessDiver V4.301 build 5888 AccessDiver is...

AccessDiver 4.301 - Buffer Overflow

Exploit for windows platform in category dos / poc + Credits: hyp3rlinx Vendor: ============== M. Jean Fages www.accessdiver.com circa 1998-2006 Product: ============================= AccessDiver V4.301 build 5888 AccessDiver is a security tester for Web pages. It has got a set of tools which wil...

Phabricator: Server Side Request Forgery in macro creation

mongoose just getting it out of the way ; Hi, I would like to report a Server Side Request Forgery SSRF 1 in the meme creation section of the phabricator software 2. SSRF is a vulnerability allowing requests to be made from the context of the server. This could allow an attacker to gain access to...

Simple Slider 1.0 - New Image URL Field XSS

The Simple Slider WordPress plugin was affected by a New Image URL Field XSS security vulnerability...

PYSEC-2013-19

Cross-site scripting XSS vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField...

Open Journal Systems (OJS) 2.3.6 - index.php?authors[][url] Cross-Site Scripting

Open Journal Systems OJS 2.3.6 - index.php?authorsurl Cross-Site Scripting source: https://www.securityfocus.com/bid/52666/info Open Journal Systems is prone to following multiple vulnerabilities because the software fails to sufficiently sanitize user-supplied input: 1. An arbitrary-file-deletio...

DEBIAN-CVE-2011-4138

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...

Bugzilla < 3.2.10 / 3.4.10 / 3.6.4 Multiple Vulnerabilities

Binary data 5744.prm...

CVE-2010-3687

Unspecified vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to bypass validation have an unspecified impact by "injecting arbitrary values into validated fields," as demonstrated using the 1 Email and 2 URL fields...