116 matches found
CVE-2018-19421
CVE-2018-19421 affects GetSimpleCMS 3.3.15. The vulnerability arises in the upload handling: admin/upload-uploadify.php and the validation routine in admin/inc/security_functions.php interact with admin/upload.php, which blocks .html uploads but allows Internet Explorer to render HTML elements co...
osCommerce Code Execution Vulnerability
osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. A security vulnerability exists in the .htaccess file of the http://host ip/oscommerce2/catalog/images/ page in osCommerce version 2.3.4.1. The vulnerability can be exploited to execute arbitrary code or...
CVE-2018-9459
In Attachment of Attachment.java and getFilePath of EmlAttachmentProvider.java, there is a possible Elevation of Privilege due to a path traversal error. This could lead to a remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2018-18966
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer render HTML elements in a .eml file...
CVE-2018-18966
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer render HTML elements in a .eml file...
CVE-2018-18966
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer render HTML elements in a .eml file...
CVE-2018-10497
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...
CVE-2018-10497
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...
Design/Logic Flaw
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...
CVE-2018-10497
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...
Design/Logic Flaw
In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...
CVE-2018-17031
In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...
CVE-2018-17031
In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...
CVE-2018-17031
In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...
PT-2018-13849 · Gogs · Gogs
Name of the Vulnerable Software and Affected Versions: Gogs version 0.11.53 Description: The issue allows an attacker to trigger MIME type sniffing using a crafted .eml file, leading to XSS. This is demonstrated by Internet Explorer and is caused by the lack of an "X-Content-Type-Options: nosniff...
Samsung Email Privilege Access Control Vulnerability
Samsung Email is an application from Samsung South Korea for sending, receiving and managing e-mail. A privilege=access control vulnerability exists in the handling of EML files in Samsung Email, which stems from the program failing to properly validate user-submitted data. The vulnerability can ...
EMLsoft 'numPerPage' Parameter SQL Injection Vulnerability
EMLsoft is an enterprise address book management system. A SQL injection vulnerability exists in the upload\eml\action\action.address.php file in EMLsoft version 5.4.5. A remote attacker can exploit this vulnerability to view, add, modify or delete information in the back-end database with the he...
Cross site request forgery (csrf)
An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF...
