8218 matches found
hw: Vector Register Leakage-Active
A flaw was found in the Intel Advanced Vector Extensions AVX implementation, where a local authenticated attacker with the ability to execute AVX instructions can gather the AVX register state from previous AVX executions. This vulnerability allows information disclosure of the AVX register state...
Microsoft Exchange Server 代码注入漏洞
Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. A remote code execution vulnerability exists in Microsoft Exchange Server. An attacker could exploit this vulnerability to achieve remote code execution...
ImageMagick Digital Error Vulnerability (CNVD-2021-10264)
ImageMagick is a software for creating, editing, and compositing images that can read, convert, and write images in many formats. A numeric error vulnerability exists in GammaImage in /MagickCore/enhance.c in versions of ImageMagick prior to 7.0.8-68. An attacker could cause a denial of service b...
Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site Scripting
Stored Cross-Site Scripting vulnerabilities in Themify Portfolio Post = 1.1.5 allow low-privileged users Contributor+ to inject arbitrary Javascript code or HTML in posts where the Themify Custom Panel is embedded. PoC 1. As a contributor, go into "Portfolios" tab from the sidebar and create a ne...
Perfex CRM 2.4.4 Cross Site Scripting
Document Title: =============== Perfex v2.4.4 CRM - Print Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2231 Release Date: ============= 2020-06-24 Vulnerability Laboratory ID VL-ID: ==================================== 22...
Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site Scripting
Stored Cross-Site Scripting vulnerabilities in Themify Portfolio Post 3. Publish/Send for review and visit created post/preview as editor/admin to trigger XSS...
CVE-2020-13542
A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Depending on the vector chosen, an attacker can either replace the service binary or replace DLL files loaded by the service, both which get executed by a service thus executing...
Vulnerability of syntactic analysis and event loading in SVG code of Firefox web browser and Thunderbird email client, allowing attackers to perform cross-site scripting attacks (XSS).
The vulnerability of syntax analysis and event loading in SVG code of Firefox web browsers and Thunderbird email clients is related to the lack of integrity checks. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...
User Registration & Login and User Management System 2.1 - Cross Site Request Forgery
Exploit Title: User Registration & Login and User Management System 2.1 - Cross Site Request Forgery Exploit Author: Dipak Panchalth3.d1p4k Vendor Homepage: https://phpgurukul.com Software Link: http://user-registration-login-and-user-management-system-with-admin-panel Version: 5 Tested on Window...
Online News Portal System 1.0 - 'Title' Stored Cross Site Scripting
Exploit Title: Online News Portal System 1.0 - 'Title' Stored Cross Site Scripting Date: 24-11-2020 Exploit Author: Parshwa Bhavsar Vendor Homepage: https://www.sourcecodester.com/php/14600/online-news-portal-using-phpmysqli-source-code.html Software Link:...
EgavilanMedia User Registration And Login System With Admin Panel 1.0 CSRF
Exploit Title: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - CSRF Date: 01-12-2020 Exploit Author: Hardik Solanki Vendor Homepage: http://egavilanmedia.com Software Link:...
Under Construction Page with CPanel 1.0 - SQL injection
Exploit Title: Under Construction Page with CPanel 1.0 - SQL injection Date: 17-11-2020 Exploit Author: Mayur Parmarth3cyb3rc0p Vendor Homepage: http://egavilanmedia.com Software Link : http://egavilanmedia.com/under-construction-page-with-cpanel/ Version: 1.0 Tested on: PopOS SQL Injection: SQL...
CVE-2020-8539
CVE-2020-8539 affects Kia Motors head units (SOP.003.30.18.0703, SOP.005.7.181019, SOP.007.1.191209). The vulnerability arises from an arbitrary command execution via the micomd daemon, enabling an attacker with local access to inject commands and generate CAN frames on the M-CAN multimedia bus. ...
Mozilla: XSS through paste (manual and clipboard API)
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...
Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability...
Mozilla: XSS through paste (manual and clipboard API)
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...
Mozilla: XSS through paste (manual and clipboard API)
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...
Mozilla: XSS through paste (manual and clipboard API)
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...
openSUSE Security Update : ucode-intel (openSUSE-2020-2098)
This update for ucode-intel fixes the following issues : - Updated Intel CPU Microcode to 20201118 official release. bsc1178971 - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL...
WonderCMS 3.1.3 - 'page' Persistent Cross-Site Scripting
Exploit Title: WonderCMS 3.1.3 - 'page' Persistent Cross-Site Scripting Date: 20-11-2020 Exploit Author: Mayur Parmar Vendor Homepage: https://www.wondercms.com/ Version: 3.1.3 Tested on: PopOS Stored Cross-site scriptingXSS: Stored attacks are those where the injected script is permanently store...