1704 matches found
Code injection
Special crafted InPage document leads to arbitrary code execution in InPage reader...
CVE-2017-1000146
Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to the arbitrary execution of Javascript in the browser of a logged-in user because the title of the portfolio page was not being properly escaped in the AJAX script that updates the Add/remove watchlist link o...
CVE-2017-1000146
Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to the arbitrary execution of Javascript in the browser of a logged-in user because the title of the portfolio page was not being properly escaped in the AJAX script that updates the Add/remove watchlist link o...
WordPress WPDB SQL Injection Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. WordPress WPDB SQL injection vulnerability can be exploited by an attacker to execute arbitrary SQL commands, as $wpdb-prepar...
phpCollab SQL Injection Vulnerability
phpCollab is an open source Internet enablement system for projects that require collaboration over the Internet. A SQL injection vulnerability exists in phpCollab 2.5.1 and earlier versions. The vulnerability can be exploited by remote attackers to execute arbitrary SQL commands via the id...
Cross-site Scripting (XSS)
genix/cms is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the id field in /inc/lib/backend/menus.control.php, allowing a malicious user to inject and execute arbitrary web script...
Immunity Canvas: EMACS_ENRICHED
Name| emacsenriched ---|--- CVE| CVE-2017-14482 Exploit Pack| CANVAS Description| Emacs Enriched Mime-type Handler Arbitrary ELISP Execution Notes| CVE Name: CVE-2017-14482 VENDOR: https://www.gnu.org/software/emacs/ Notes: Either email this to someone using the GNUS email client or convince them...
Concrete5 SQL Injection Vulnerability (CNVD-2017-32457)
concrete5 is a free content management system CMS. The system can be edited and typeset directly on the page. A SQL injection vulnerability exists in concrete5 version 5.7.3.1, which originates when the program fails to properly validate user input before using SQL query statements. A remote...
CVE-2017-10844
baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors...
Code injection
baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors...
[ASA-201708-18] thunderbird: multiple issues
Arch Linux Security Advisory ASA-201708-18 ========================================== Severity: Critical Date : 2017-08-23 CVE-ID : CVE-2017-7753 CVE-2017-7779 CVE-2017-7784 CVE-2017-7785 CVE-2017-7786 CVE-2017-7787 CVE-2017-7791 CVE-2017-7792 CVE-2017-7800 CVE-2017-7801 CVE-2017-7802 CVE-2017-78...
NexusPHP SQL Injection Vulnerability
NexusPHP is a resource sharing community solution written in PHP developed by the Nexus team in China. SQL injection vulnerability in the massmail.php file in NexusPHP version 1.5. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...
Synology Office Command Injection Vulnerability
Synology Office is a web-based office software system from Synology. The system features online document and spreadsheet creation, as well as importing local files. A command injection vulnerability exists in the Document.php file in Synology Office versions 2.2.0-1502 and 2.2.1-1506. A remote...
UBUNTU-CVE-2017-9800
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...
Cross site scripting
services/systemio/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution involving a ContactCommon field on victims who click on a crafted link, aka XSS...
Cross-site Scripting (XSS)
Bolt CMS is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input, allowing a malicious user to inject and execute arbitrary javascript through the Title Field of a new entry...
Code injection
Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading functions in the installer plugin. A successful exploitation could lead to arbitrary code execution...
Inflection: XSS at https://app.goodhire.com/member/GH.aspx
Unescaped input from a URL parameter in the checkout flow was being used as a JavaScript variable for determining what cart contents to render. By manipulating the URL parameter, the researcher was able to execute arbitrary JavaScript on the page...
CVE-2017-8768
Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...