CVE-2018-14732

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket...

Code injection

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket...

CVE-2018-14732

CVE-2018-14732 affects webpack-dev-server before 3.1.6. The WebSocket server used for Hot Module Replacement does not validate the request origin, allowing any origin (including ws://127.0.0.1:8080/) to receive HMR messages. This can enable an attacker to access a developer’s source code from a p...

CVE-2018-14732

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket...

PT-2018-12689 · Webpack · Webpack-Dev-Server

Name of the Vulnerable Software and Affected Versions: webpack-dev-server versions prior to 3.1.10 webpack-dev-server versions prior to 3.1.6 Description: An issue in the WebSocket server used for Hot Module Replacement HMR allows attackers to steal a developer's source code because the origin of...

Debian DSA-4296-1 : mbedtls - security update

Two vulnerabilities were discovered in mbedtls, a lightweight crypto and SSL/TLS library which could result in plain text recovery via side-channel attacks. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-429...

openSUSE Security Update : qemu (openSUSE-2018-996)

This update for qemu fixes the following issues : This security issue was fixed : - CVE-2018-12617: qmpguestfileread had an integer overflow that could have been exploited by sending a crafted QMP command including guest-file-read with a large count value to the agent via the listening socket...

Security update for qemu (moderate)

This update for qemu fixes the following issues: This security issue was fixed: - CVE-2018-12617: qmpguestfileread had an integer overflow that could have been exploited by sending a crafted QMP command including guest-file-read with a large count value to the agent via the listening socket causi...

CVE-2018-16648

In Artifex MuPDF 1.13.0, the fzappendbyte function in fitz/buffer.c allows remote attackers to cause a denial of service segmentation fault via a crafted pdf file. This is caused by a pdf/pdf-device.c pdfdevalpha array-index underflow...

Remote Code Execution

Overview react-dev-utils on Windows is vulnerable to remote code execution. Recommendation Update to one of the follow versions, depending on the release line that you are using. - 1.0.4 - 2.0.2 - 3.1.2 - 4.2.2 - 5.0.2 - 6.0.0-next.a671462c References -...

Monstra-Dev 3.0.4 - Cross-Site Request Forgery (Account Hijacking) Vulnerability

Exploit for php platform in category web applications Exploit Title: Monstra-Dev 3.0.4 - Cross-Site Request ForgeryAccount Hijacking Exploit Author: Nainsi Gupta Vendor Homepage: http://monstra.org/ Product Name: Monstra-dev Version: 3.0.4 Tested on: Windows 10 Firefox/Chrome CVE : N/A 1...

Monstra-Dev 3.0.4 - Cross-Site Request Forgery (Account Hijacking)

Exploit Title: Monstra-Dev 3.0.4 - Cross-Site Request ForgeryAccount Hijacking Date: 2018-08-04 Exploit Author: Nainsi Gupta Vendor Homepage: http://monstra.org/ Product Name: Monstra-dev Version: 3.0.4 Tested on: Windows 10 Firefox/Chrome CVE : N/A 1. Description CSRF vulnerability in...

Monstra-Dev 3.0.4 - Cross-Site Request Forgery (Account Hijacking)

Monstra-Dev 3.0.4 - Cross-Site Request Forgery Account Hijacking Exploit Title: Monstra-Dev 3.0.4 - Cross-Site Request ForgeryAccount Hijacking Date: 2018-08-04 Exploit Author: Nainsi Gupta Vendor Homepage: http://monstra.org/ Product Name: Monstra-dev Version: 3.0.4 Tested on: Windows 10...

Monstra-Dev 3.0.4 Cross Site Scripting

Exploit Title:Monstra-Dev 3.0.4 Stored Cross Site Scripting Date: 04-08-2018 Exploit Author: Nainsi Gupta Vendor Homepage: http://monstra.org/ Software Link: https://github.com/monstra-cms/monstra Published In- https://indiancybersecuritysolutions.com/cve-2018-14922-cross-site-scripting/ Product...

Monstra 3.0.4 - Cross-Site Scripting

Monstra 3.0.4 - Cross-Site Scripting. CVE-2018-14922. Webapps exploit for PHP platform Exploit Title:Monstra-Dev 3.0.4 Stored Cross Site Scripting Date: 04-08-2018 Exploit Author: Nainsi Gupta Vendor Homepage: http://monstra.org/ Software Link: https://github.com/monstra-cms/monstra Published In-...

Monstra 3.0.4 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title:Monstra-Dev 3.0.4 Stored Cross Site Scripting Exploit Author: Nainsi Gupta Vendor Homepage: http://monstra.org/ Software Link: https://github.com/monstra-cms/monstra Published In-...

dev-srv (>=0.1.3 <=0.3.1), gfm-srv (>=0.0.2 <=1.1.3) potentially affected by CVE-2018-3714 via node-srv (>=0.3.3 <=1.2.6)

node-srv NPM version =0.3.3, =0.1.3, =0.0.2, =1.1.3 Source cves: CVE-2018-3714 Source advisory: OSV:GHSA-52R9-G5G6-2HJP...

dev-insider.de XSS vulnerability

Open Bug Bounty ID: OBB-650899 Description| Value ---|--- Affected Website:| dev-insider.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Debian: Security Advisory (DLA-1429-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 27 : gnupg (2018-69780fc4d7)

New upstream v1.4.23 1589802,1589620,1589624 - Remove patches included in upstream release - Note that this includes the fix for CVE-2018-12020 ---- - doc Remove documentation for future option faked sys - build Don't use dev srandom on OpenBSD - Do not use C99 feature - g10 Fix regexp...