cnvs Canvas Cross-Site Scripting Vulnerability

cnvs.io Canvas is a blog publishing platform. An XSS cross-site scripting vulnerability exists in the title and content fields of the "Posts Add New" action and during the creation of new tags and users in Canvas, which can be exploited by attackers to steal sensitive information such as cookies...

Code injection

cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...

CVE-2017-8298

cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...

CVE-2017-8298

cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...

CVE-2017-8298

cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...

CVE-2017-8298

CVE-2017-8298 affects cnvs.io Canvas 3.3.0. The vulnerability is a Cross‑Site Scripting (XSS) issue present in the title and content fields when using the Posts > Add New action, and during creation of new tags and users. The provided connected documents confirm the same description across mul...

Immunity Canvas: SOLARIS_RPC_LIBNSL

Name| solarisrpclibnsl ---|--- CVE| CVE-2017-3623 Exploit Pack| CANVAS Description| Solaris libnsl RPC - Remote Heap Overflow Notes| References: http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html CVE Name: CVE-2017-3623 VENDOR: Oracle Repeatability: Unlimited Date public:...

Immunity Canvas: IIS6_PROPFIND

Name| iis6propfind ---|--- CVE| CVE-2017-7269 Exploit Pack| CANVAS Description| IIS 6.0 PROPFIND ScStoragePathFromUrl Stack Buffer Overflow Notes| References: 'https://vulners.com/cve/CVE-2017-7269', 'https://github.com/edwardz246003/IISexploit' CVE Name: CVE-2017-7269 VENDOR: Microsoft...

Immunity Canvas: LINUX_SCREEN

Name| linuxscreen ---|--- CVE| CVE-2017-5618 Exploit Pack| CANVAS Description| GNU Screen v4.5.0 local privilege escalation Notes| CVE Name: CVE-2017-5618 VENDOR: GNU Notes: Tested on: Ubuntu 16.10 x64 Ubuntu 16.04 LTS x64 Ubuntu 14.10 LTS x64 Ubuntu 14.04 LTS x32 Repeatability: Infinite...

Immunity Canvas: MS17_010

Name| ms17010 ---|--- CVE| CVE-2017-0143, CVE-2017-0146 Exploit Pack| CANVAS Description| MS17-010 Notes| CVE Name: CVE-2017-0143, CVE-2017-0146 VENDOR: Microsoft NOTES: https://github.com/worawit/MS17-010 https://www.crowdstrike.com/blog/badrabbit-ms17-010-exploitation-part-one-leak-and-control/...

Immunity Canvas: ETERNALBLUE

Name| ETERNALBLUE ---|--- CVE| CVE-2017-0143 Exploit Pack| CANVAS Description| ETERNALBLUE Notes| CVE Name: CVE-2017-0143 VENDOR: Microsoft NOTES: Due to the complexity of the bug, this exploit will never be 100% reliable. Please READ THE EXPLOIT SOURCE for more information and notes...

Immunity Canvas: STRUTS_OGNL

Name| strutsognl ---|--- CVE| CVE-2017-5638 Exploit Pack| CANVAS Description| strutsognl Notes| CVE Name: CVE-2017-5638 VENDOR: Apache NOTES: The JAR Server will listen on the port provided in the UI. However, if that port is unavailable, a random one will be chosen. Example vulnerable applicatio...

UBUNTU-CVE-2017-5406

A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks. This vulnerability affects Firefox 52 and Thunderbird 52...

Design/Logic Flaw

The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas...

Immunity Canvas: MAGENTO_SET_PAY_INFO

Name| magentosetpayinfo ---|--- CVE| CVE-2016-4010 Exploit Pack| CANVAS Description| Magento unauthenticated unserialize 2.0.6 Notes| Repeatability: Infinite VENDOR: Magento CVE Url: https://vulners.com/cve/CVE-2016-4010 CVE Name: CVE-2016-4010...

Immunity Canvas: MAGENTO_SET_PAYMENT_INFO

Name| magentosetpaymentinfo ---|--- CVE| CVE-2016-4010 Exploit Pack| CANVAS Description| Magento unauthenticated unserialize 2.0.6 Notes| Repeatability: Infinite VENDOR: Magento CVE Url: https://vulners.com/cve/CVE-2016-4010 CVE Name: CVE-2016-4010...

CVE-2016-9446

The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas...

UBUNTU-CVE-2016-9446

The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas...

CVE-2016-9446

The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas...

CVE-2016-9446

The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas...