PT-2018-14749

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1 Description The issue concerns an incomplete '.htaccess' file for blacklist filtering in the product page of osCommerce. Specifically, the .htaccess file in the catalog/images/ directory bans the html extension, but...

CVE-2018-18966: Undefined Security Weakness

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer render HTML elements in a .eml file...

Design/Logic Flaw

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...

CVE-2018-10497

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...

CVE-2018-10497

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...

CVE-2018-10497

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...

CVE-2018-10497: Improper Input Validation

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...

Design/Logic Flaw

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...

CVE-2018-17031

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...

CVE-2018-17031

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...

CVE-2018-17031

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...

CVE-2018-17031

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...

PT-2018-13849 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs version 0.11.53 Description: The issue allows an attacker to trigger MIME type sniffing using a crafted .eml file, leading to XSS. This is demonstrated by Internet Explorer and is caused by the lack of an "X-Content-Type-Options: nosniff...

Samsung Email Privilege Access Control Vulnerability

Samsung Email is an application from Samsung South Korea for sending, receiving and managing e-mail. A privilege=access control vulnerability exists in the handling of EML files in Samsung Email, which stems from the program failing to properly validate user-submitted data. The vulnerability can ...

EMLsoft 'numPerPage' Parameter SQL Injection Vulnerability

EMLsoft is an enterprise address book management system. A SQL injection vulnerability exists in the upload\eml\action\action.address.php file in EMLsoft version 5.4.5. A remote attacker can exploit this vulnerability to view, add, modify or delete information in the back-end database with the he...

Cross site request forgery (csrf)

An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF...

CVE-2018-14964

An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page...

PT-2018-12843

Name of the Vulnerable Software and Affected Versions EMLsoft version 5.4.5 Description An issue was discovered that allows Cross-Site Request Forgery CSRF on the "eml/upload/eml/?action=user&do=add" API endpoint. Recommendations For EMLsoft version 5.4.5, consider implementing CSRF protection...

CVE-2018-14966: Cross-Site Request Forgery (CSRF)

An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=user&do=add page allows CSRF...

PT-2018-12841

Name of the Vulnerable Software and Affected Versions EMLsoft version 5.4.5 Description A security issue was found in the software, where a Cross-Site Scripting XSS attack can be performed. This issue is related to the "eml/upload/eml/?action=address&do=edit" page, which is an API endpoint...