Atlassian Confluence Server Cross-Site Scripting Vulnerability (CNVD-2018-03443)

Atlassian Confluence Server is a suite of professional enterprise knowledge management and collaboration software from Atlassian Australia, which can also be used to build an enterprise WiKi. the software enables collaboration and knowledge sharing amongst team members. A cross-site scripting...

AZL-43897 CVE-2012-6708 affecting package python-httplib2 0.20.3-3

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

CVE-2018-2699

Vulnerability in the Application Express component of Oracle Database Server. The supported version that is affected is Prior to 5.1.4.00.08. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Express. Successful attacks require...

LiveZilla knowledgebase.php file cross-site scripting vulnerability

LiveZilla is a free online customer service system from the German company LiveZilla. The system provides real-time monitoring of visitors, offline messages, GeoTracking map tracking, access statistics, online chat and other features. A cross-site scripting vulnerability exists in the...

CVE-2017-16556

In K7 Antivirus Premium before 15.1.0.53, user-controlled input can be used to allow local users to write to arbitrary memory locations...

DEBIAN-CVE-2016-6810

In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation...

CVE-2018-5263

The StackIdeas EasyDiscuss aka comeasydiscuss extension before 4.0.21 for Joomla! allows XSS...

DuoLingo TinyCards application for Android Man-in-the-Middle Attack Vulnerability

DuoLingo TinyCards application for Android is a memory workout application based on the Android platform. A security vulnerability exists in versions of the DuoLingo TinyCards application for Android prior to version 1.0, which stems from the program's use of unencrypted HTTP, and can be exploite...

QtPass Password Generation Vulnerability

QtPass is a Unix password manager with a graphical user interface maintained by the Dutch organization IJhack. A security vulnerability exists in versions of QtPass prior to 1.2.1. An attacker can exploit the vulnerability to predict and enumerate passwords...

POCO 'ZipCommon::isValidPath()' function absolute path traversal vulnerability

POCO C++ Libraries is a set of C++ class libraries developed by Austrian software developer Gunter Obiltschnig, which are used to develop portable web-based applications with threading, file and streaming capabilities. A security vulnerability in the 'ZipCommon::isValidPath' function in the...

UBUNTU-CVE-2017-7848

RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird 52.5.2...

WordPress ResAds Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation of a set of PHP language development of blogging platform , the platform supports in PHP and MySQL server set up personal blog site.ResAds plugin is used in one of the display formatting plugin for adaptation to a variety of endpoints. A cross-site...

Quest NetVault Backup SQL Injection Vulnerability (CNVD-2017-37633)

Quest NetVault Backup is a suite of data backup software from Quest Software, USA. A SQL injection vulnerability in the handling of NVBUBackup PluginList method requests in Quest NetVault Backup versions prior to 11.4.5 stems from the program's failure to properly detect user-submitted strings...

Synology MailPlus Server Disclaimer Cross-Site Scripting Vulnerability

Synology MailPlus Server is an email service suite from Synology. The product supports managing user accounts, email records, etc. Disclaimer is one of the disclaimer modules. A cross-site scripting vulnerability exists in Disclaimer in Synology MailPlus Server versions prior to 1.4.0-0415. A...

UrBackup Server Cross-Site Scripting Vulnerability

UrBackup is an easy to install open source client/server backup system . A cross-site scripting vulnerability exists in UrBackup Server before 2.1.20. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the action parameter...

CVE-2017-3104

Adobe RoboHelp has a cross-site scripting XSS vulnerability. This affects versions before RH12.0.4.460 and RH2017 before RH2017.0.2...

McAfee Network Security Manager Remote Authorization Bypass Vulnerability

McAfee Network Security Manager NSM is a network security solution from McAfee that enables real-time monitoring of deployed McAfee intrusion prevention systems across the network. A remote authorization bypass vulnerability exists in McAfee NSM versions prior to 8.2.7.71.1. A remote attacker cou...

CVE-2017-8137

HedEx Earlier than V200R006C00 versions has a dynamic link library DLL hijacking vulnerability due to calling the DDL file by accessing a relative path. An attacker could exploit this vulnerability to tamper with the DLL file, leading to DLL hijacking...

CVE-2017-2737

VCM5010 with software versions earlier before V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the files that uploaded. An authenticated attacker could upload arbitrary files to the system...

private_address_check ruby gem server-side request forgery vulnerability

privateaddresscheck ruby gem is a Ruby-based checking tool for server-side request forgery attacks. A server-side request forgery vulnerability exists in versions of the privateaddresscheck ruby gem prior to 0.4.1. An attacker can exploit this vulnerability to bypass blacklists and perform...