Cross site scripting

A vulnerability in the web-based management interface of Cisco DNA Center could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of...

HTML5 Video Player 1.2.5 - Local Buffer Overflow (Non SEH)

!/usr/bin/python Exploit Title: HTML5 Video Player 1.2.5 - Local Buffer Overflow - Non SEH Date: 27/01/2019 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: http://www.html5videoplayer.net/download.html Software: http://www.html5videoplayer.net/html5videoplayer-setup.exe Contact:...

GHSA-4662-J96G-MV46 Arbitrary Code Injection in reduce-css-calc

Affected versions of reduce-css-calc pass input directly to eval. If user input is passed into the calc function, this may result in cross-site scripting on the browser, or remote code execution on the server. Proof of Concept const reduceCSSCalc = require'reduce-css-calc';...

WordPress Testimonial Slider plugin <=1.2.4 - Authenticated SQL Injection vulnerability

Authenticated SQL Injection vulnerability found by DefenceCode in WordPress Testimonial Slider plugin versions =1.2.4. Solution Update the WordPress Testimonial Slider plugin to the latest version at least 1.2.5...

WordPress Testimonial Slider plugin <=1.2.4 - Authenticated SQL Injection vulnerability

Authenticated SQL Injection vulnerability found by DefenceCode in WordPress Testimonial Slider plugin versions =1.2.4. Solution Update the WordPress Testimonial Slider plugin to the latest version at least 1.2.5...

OpenWebif 'CallOPKG' Function Remote Command Execution Vulnerability

OpenWebif is an open source web interface plug-in for Linux-based set-top boxes. A security vulnerability exists in OpenWebif version 1.2.5, which originates from the failure of the 'CallOPKG' function of the IpkgController class in the plugin/controllers/ipkg.py file to restrict or correctly...

PCManFM Local Denial of Service Vulnerability

PCManFM is a Chinese programmer Hong Ren Oracle developed a set of open source, free file management software. A local denial of service vulnerability exists in PCManFM version 1.2.5. A local attacker can exploit this vulnerability to cause a denial of service application unavailability...

UBUNTU-CVE-2017-8934

PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service application unavailability...

CVE-2017-8114

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin...

WordPress NewStatPress 1.2.4 Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Source: https://sumofpwn.nl/advisory/2016/persistentcrosssitescriptinginthewordpressnewstatpressplugin.html Abstract A persistent Cross-Site Scripting XSS vulnerability has been found in the WordPress NewStatPress plugin. By using this...

WordPress Plugin NewStatPress 1.2.4 - Cross-Site Scripting

WordPress Plugin NewStatPress 1.2.4 - Cross-Site Scripting Source: https://sumofpwn.nl/advisory/2016/persistentcrosssitescriptinginthewordpressnewstatpressplugin.html Abstract A persistent Cross-Site Scripting XSS vulnerability has been found in the WordPress NewStatPress plugin. By using this...

PT-2016-3363

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 1.2.5 Description The issue is related to the "remember me" feature in Apache Shiro, where the lack of a configured cipher key allows remote attackers to execute arbitrary code or bypass intended access...

Vulnerabilities of the Red Hat Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information

The iptables-ipv6-1.2.5 package from the Red Hat Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to breaches of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited locally...

Multiple SQL Injection Vulnerabilities in Joomla! Web-Dorado ECommerce WD Components

Joomla! is a U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds , site search and other functions.Web-Dorado ECommerce WD comecommercewd is one of the e-commerce components . A SQL injection vulnerability exists in version 1.2...

Joomla! Component ECommerce-WD 1.2.5 - SQL Injection

Version 1.2.5 of the ECommerce-WD plugin for Joomla! has multiple unauthenticated SQL injections available via the advanced search functionality. http://extensions.joomla.org/extension/ecommerce-wd The vulnerable parameters are searchcategoryid, sortorder, and filtermanufacturerids within the...

JVN#16485017: SLFileManager for Android vulnerable to directory traversal

SLFileManager provided by S-Link, Inc. contains a flaw in processing file names, which may result in a directory traversal CWE-22 vulnerability. Impact A remote, unauthenticated attacker may create an arbitrary file or overwrite an existing file in a directory that the application has privileges ...

WordPress Unconfirmed Plugin 's'插件跨站脚本漏洞

Bugtraq ID:66781 WordPress是一种使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志。 WordPress Unconfirmed插件不正确过滤's'参数，远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 WordPress Unconfirmed Plugin 1.2.4 WordPress Unconfirmed 1.2.5版本已修复该漏洞，建议用户下载使用： http://wordpress.org/plugins/unconfirmed...

Sharebar <= 1.2.5 - Reflected Cross-Site Scripting (XSS)

sharebar-admin.php page Parameter XSS...

WordPress Sharebar 1.2.5 Cross Site Scripting

Exploit Title : Wordpress sharebar plugin Cross site scripting Vulnerability Exploit Author : Ashiyane Digital Security Team Google Dork: : inurl:/wp-content/plugins/sharebar Date: 2013/09/24 Vendor Homepage : http://wordpress.org/plugins/sharebar Software Link :...

WebCalendar Pre-Auth PHP Code Execution

Added: 05/18/2012 CVE: CVE-2012-1495 BID: 53207 OSVDB: 80097 Background WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. Problem WebCalendar fails to properly...