CVE-2018-17133

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting...

Monstra CMS Insecure Direct Object Reference Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. An insecure direct object reference vulnerability exists in Monstra CMS version 3.0.4, which can be exploited...

Google Chrome URL Spoofing Vulnerability (CNVD-2018-22398)

Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in the full-screen mode in Google Chrome versions prior to 69.0.3497.81. A remote attacker can exploit the vulnerability to forge URLs...

CVE-2018-15480

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The cloud API had a hidden parameter, which allowed an authenticated...

Google Chrome Omnibox Spoofing Vulnerability (CNVD-2018-20140)

Google Chrome is a web browser developed by Google, Inc. and Omnibox is a real-time search engine. A security vulnerability exists in Omnibox in versions of Google Chrome prior to 63.0.3239.84, which stems from insufficient policy enforcement. The vulnerability can be exploited by remote attacker...

Google Chrome Omnibox Spoofing Vulnerability (CNVD-2018-20141)

Google Chrome is a web browser developed by Google, Inc. and Omnibox is a real-time search engine. A security vulnerability exists in Omnibox in versions of Google Chrome prior to 63.0.3239.84, which stems from insufficient policy enforcement. The vulnerability can be exploited by remote attacker...

curl: Invalid URL parsing with '#'

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC t...

CVE-2018-5544

When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages pages with a logon agent or a confirm box, the BIG-IP APM may disclose configuration information such as partition and agent names via URI parameters...

Google Chrome URL Spoofing Vulnerability (CNVD-2018-17050)

Google Chrome is a web browser developed by the American company Google Google. A URL spoofing vulnerability exists in Omnibox in Google Chrome. A remote attacker can exploit this vulnerability to spoof URLs by tricking users into visiting specially crafted websites...

Google Chrome URL Spoofing Vulnerability (CNVD-2018-17054)

Google Chrome is a web browser developed by the American company Google Google. A URL spoofing vulnerability exists in Omnibox in Google Chrome. A remote attacker can exploit this vulnerability to spoof URLs by tricking users into visiting specially crafted websites...

Google Chrome Extensions URL Spoofing Vulnerability

Google Chrome is a web browser developed by Google, Inc.Extensions is one of the browser extensions. A security vulnerability exists in Extensions in Google Chrome versions prior to 68.0.3440.75. The vulnerability can be exploited by remote attackers to forge a UIL with the help of a specially...

Google Chrome URL Spoofing Vulnerability (CNVD-2018-17047)

Google Chrome is a web browser developed by the American company Google Google. A URL spoofing vulnerability exists in Google Chrome for iOS. A remote attacker can exploit this vulnerability to spoof URLs by tricking users into visiting specially crafted websites...

Apache Spark Cross-Site Scripting Vulnerability (CNVD-2018-15536)

Apache Spark is a large-scale data processing engine that supports acyclic data streams and in-memory computing from the Apache Software Foundation. A cross-site scripting vulnerability exists in the UI of Apache Spark versions 1.0.0 through 2.1.2, 2.2.0 through 2.2.1, and 2.3.0. A remote attacke...

node-simple-router directory traversal vulnerability

node-simple-router is a simple router for Node. A directory traversal vulnerability exists in node-simple-router. An attacker can exploit this vulnerability by placing a '... /' sequence in a URL to gain access to the file system...

Serverhuwenhui Directory Traversal Vulnerability

serverhuwenhui is an http server. A directory traversal vulnerability exists in serverhuwenhui. An attacker can exploit this vulnerability to gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

Sencisho Directory Traversal Vulnerability

Sencisho is an http server for local development. A directory traversal vulnerability exists in Sencisho. An attacker can exploit this vulnerability to gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

cyberjs directory traversal vulnerability

cyberjs is a JavaScript library for cyber. A directory traversal vulnerability exists in cyberjs. An attacker can gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

List-n-stream Directory Traversal Vulnerability

list-n-stream is a video list module. A directory traversal vulnerability exists in list-n-stream version 0.0.10 and earlier. An attacker can exploit this vulnerability to gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

Pooledwebsocket Directory Traversal Vulnerability

pooledwebsocket is a software package. A directory traversal vulnerability exists in pooledwebsocket. An attacker can exploit this vulnerability by placing a '... /' sequence in a URL to gain access to the file system...

gaoxiaotingtingting directory traversal vulnerability

The Node.js module gaoxiaotingtingting is an HTTP server. A directory traversal vulnerability exists in gaoxiaotingtingting. An attacker can exploit this vulnerability by placing ". /" in a url to access the file system...