2913 matches found
Recaf - A Modern Java Bytecode Editor
Recaf is an open-source Java bytecode editor built on top of Objectweb's ASM. ASM is a bytecode manipulation library that abstracts away the constant pool and a few other class-file attributes. Since keeping track of the constant pool and managing proper stackframes are no longer necessary, compl...
Cross-site Scripting Vulnerability in China Knowledge Network's TengYun Journal Co-Editing System
TengCloud periodicals collaborative editorial system mainly improves the three main functions of expense management, network debut, and multi-journal joint management, and at the same time provides several practical gadgets to improve the efficiency of the editors' work. A cross-site scripting...
MSHTML Engine Remote Code Execution Vulnerability
A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the...
Zendesk: Stored XSS in Macro Editing - Introduced by Admins to affect Admins
This issue was reported to us as a bypass to a previous fix by adjusting the payload. The cross-site scripting vulnerability can only be introduced by Support account administrators and only executes in a place where administrators within the account can access. We greatly appreciate the work and...
Cross site request forgery (csrf)
FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery CSRF vulnerability in All authenticated API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This attack appear to be exploitable via Victim must open a website...
CVE-2018-1000846
FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery CSRF vulnerability in All authenticated API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This attack appear to be exploitable via Victim must open a website...
CVE-2018-17777
An issue was discovered on D-Link DVA-5592 A1WI20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN 0000, it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have access to the router...
RATELIMITED: Editable Wiki repo by anyone
Description: I've created wiki page on your github repo without any permission Steps To Reproduce: https://github.com/EndlessHosting/Discord-LiveBot/wiki/Test-here Supporting Material/References: F391468 Impact Going on https://github.com/EndlessHosting/Discord-LiveBot/wiki/Test-here you can add ...
Liberapay: Publicly editable GitHub wikis
Hello team, While browsing https://github.com/liberapay I found that many of the repositories have their wikis publicly editable by any GitHub user. The following are some of the affected repositories: https://github.com/liberapay/cardregistration-js-kit/wiki...
Tcpreplay - Pcap Editing And Replay Tools For *NIX And Windows
Tcpreplay is a suite of GPLv3 licensed utilities for UNIX and Win32 under Cygwin operating systems for editing and replaying network traffic which was previously captured by tools like tcpdump and Ethereal/Wireshark. It allows you to classify traffic as client or server, rewrite Layer 2, 3 and 4...
MariaDB: Github wiki is editable by anyone
Some of our GitHub repos had default public Wiki editing turned on, which could be used with malicious intent...
DRUPAL-CONTRIB-2018-074
This base theme bridges the gap between Drupal and the Bootstrap Framework. The theme doesn't sufficiently filter valid targets under the scenario of opening modals, popovers, and tooltips. This vulnerability is mitigated by the fact that an attacker must already have the ability to either: 1...
WordPress 4.2.x < 4.2.11 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An...
WordPress 3.9.x < 3.9.15 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An...
WordPress 3.7.x < 3.7.17 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An...
RHEL 7 : zsh (RHSA-2018:3073)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3073 advisory. The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh...
CVE-2018-18745
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...
CVE-2018-18745
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...