KDE kio-extras HTML Thumbnailer Plugin Information Disclosure Vulnerability

KDE is a free and open source X desktop management program for Linux and Unix workstations. kDE provides support for a variety of network protocols through the KIO subsystem. kio-extras is one of the components used to increase the functionality of KIO. HTML Thumbnailer plug-in is one of the...

UBUNTU-CVE-2018-6078

Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted domain name...

curl: URL globbing out of bounds read

curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a...

curl: Invalid URL parsing with '#'

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC t...

Open Ticket Request System Cross-Site Scripting Vulnerability (CNVD-2019-09605)

Open Ticket Request System OTRS is an open source defect tracking and management system software. Open Ticket Request System OTRS suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to execute JavaScript code via URL manipulation...

gdk-pixbuf2: Heap overflow in the gdk_pixbuf__jpeg_image_load_increment function

An exploitable heap overflow vulnerability exists in the gdkpixbufjpegimageloadincrement functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability...

IBM WebSphere Commerce Open Redirect Vulnerability

IBM WebSphere Commerce is a suite of e-business solutions from IBM in the United States. The solution supports all sales business models, including B2C, B2B and B2B2C, on a single customer interaction platform. An open redirection vulnerability exists in IBM WebSphere Commerce. A remote attacker...

Foxit Reader and Foxit PhantomPDF for Windows Memory Misreference Vulnerability (CNVD-2018-23732)

Foxit Reader for Windows is a Windows-based PDF document reader from China's Foxit Foxit Software Corporation.Foxit PhantomPDF for Windows is its commercial version. A memory misreference vulnerability exists in the handling of the gotoURL method of the host object in Foxit Reader 9.2.0.9297 and...

IBM WebSphere Application Server Directory Traversal Vulnerability (CNVD-2018-21190)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A directory traversal vulnerability exists in IBM WAS. A...

SAP BusinessObjects BI Platform Servers Information Disclosure Vulnerability

SAP BusinessObjects Business Intelligence BI Platform Servers is a suite of business intelligence software and enterprise performance solutions from SAP. The product has a report generation, analysis, data visualization, etc. Software Development Kit SDK is one of the software development kit. An...

UBUNTU-CVE-2018-4309

A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...

CVE-2018-17133

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting...

Monstra CMS Insecure Direct Object Reference Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. An insecure direct object reference vulnerability exists in Monstra CMS version 3.0.4, which can be exploited...

Google Chrome URL Spoofing Vulnerability (CNVD-2018-22398)

Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in the full-screen mode in Google Chrome versions prior to 69.0.3497.81. A remote attacker can exploit the vulnerability to forge URLs...

CVE-2018-15480

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The cloud API had a hidden parameter, which allowed an authenticated...

Google Chrome Omnibox Spoofing Vulnerability (CNVD-2018-20140)

Google Chrome is a web browser developed by Google, Inc. and Omnibox is a real-time search engine. A security vulnerability exists in Omnibox in versions of Google Chrome prior to 63.0.3239.84, which stems from insufficient policy enforcement. The vulnerability can be exploited by remote attacker...

Google Chrome Omnibox Spoofing Vulnerability (CNVD-2018-20141)

Google Chrome is a web browser developed by Google, Inc. and Omnibox is a real-time search engine. A security vulnerability exists in Omnibox in versions of Google Chrome prior to 63.0.3239.84, which stems from insufficient policy enforcement. The vulnerability can be exploited by remote attacker...

curl: Invalid URL parsing with '#'

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC t...

CVE-2018-5544

When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages pages with a logon agent or a confirm box, the BIG-IP APM may disclose configuration information such as partition and agent names via URI parameters...

Google Chrome URL Spoofing Vulnerability (CNVD-2018-17050)

Google Chrome is a web browser developed by the American company Google Google. A URL spoofing vulnerability exists in Omnibox in Google Chrome. A remote attacker can exploit this vulnerability to spoof URLs by tricking users into visiting specially crafted websites...