PT-2019-19892

Name of the Vulnerable Software and Affected Versions simple-markdown versions prior to 0.4.4 Description The issue is related to insufficient input sanitization, which allows Cross-Site Scripting XSS attacks. This can be exploited through input of links containing data or vbscript URIs and a...

PT-2019-19831

Name of the Vulnerable Software and Affected Versions Editor.md versions 1.5.0 and earlier Editor.md all versions Description The issue involves a DOM-based XSS that can be triggered through specific vectors, including the 'EMBED SRC="data:image/svg+xml' substring. It is also reported that user...

NetSetMan 4.7.1 - Local Buffer Overflow (SEH Unicode) Exploit

Exploit for windows platform in category local exploits Exploit Title: NetSetMan 4.7.1 - Local Buffer Overflow SEH Unicode Exploit Author: Devin Casadey Vendor Homepage: https://www.netsetman.com/ Software Link: https://www.netsetman.com/netsetman.exe Tested Version: 4.7.1 Tested on: Windows XP S...

NetSetMan 4.7.1 - Local Buffer Overflow (SEH Unicode)

NetSetMan 4.7.1 - Local Buffer Overflow SEH Unicode Exploit Title: NetSetMan 4.7.1 - Local Buffer Overflow SEH Unicode Exploit Author: Devin Casadey Discovery Date: 2019-03-11 Vendor Homepage: https://www.netsetman.com/ Software Link: https://www.netsetman.com/netsetman.exe Tested Version: 4.7.1...

WordPress: Stored XSS in Post Preview as Contributor

Root cause I noticed that the getthecontent makes a pregreplacecallback after all other validation and sanitization has been performed. function getthecontent $morelinktext = null, $stripteaser = false global $page, $more, $preview, $pages, $multipage; $post = getpost; ... if $preview // Preview...

Design/Logic Flaw

An issue was discovered in the registration API endpoint in 42Gears SureMDM before 2018-11-27. An attacker can submit a GET request to /api/register/:email, where :email is a base64 encoded e-mail address, to receive confirmation as to whether a user account exists in the system with the specifie...

Cross-Site Scripting (XSS)

com.liferay.expando.web is vulnerable to cross-site scripting. The modelResource parameter is not HTML encoded before being displayed on a user's browser, which allows remote attackers to inject arbitrary Javascript into the victim's browser to steal session tokens or perform unwanted actions on...

Denial Of Service (DoS)

jq is vulnerable to denial of service DoS attacks. The vulnerability exists as an off-by-one error in the tokenadd function in jvparse.c in jq allows remote attackers to cause a denial of service crash via a long JSON-encoded number, which triggers a heap-based buffer overflow...

Cross-Site Scripting (XSS)

forkcms/forkcms is vulnerable to cross-site scripting XSS. The facebookadminids parameter under the application's private settings is not validated and HTML encoded before being displayed on a user's browser, allowing a remote attacker to inject arbitrary Javascript into the victim's browser...

Cross-Site Scripting (XSS)

github.com/go-gitea/gitea is vulnerable to cross-site scripting XSS. The avatar URL is not HTML encoded when initCommentForm creates its elements. This allows a remote attacker to inject arbitrary Javascript into a victim's browser using a malformed avatar URL to steal session tokens or perform...

Directory Traversal

Retrofit is vulnerable to directory traversal. The vulnerability exists when using encoded=true in the function addPathParameter in RequestBuilder.java, which would allow an attacker to add or delete resources which are otherwise not available from the application...

CVE-2018-18767

An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app e.g., change camera settings or play lullabies, it communicates directly with the Wi-Fi camera D-Link 825L firmware 1.08 with the credentials username and password in base64 cleartext...

Directory traversal

Square Retrofit version versions from including 2.0 and 2.5.0 excluding contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources otherwise unavailable to her.. This attack...

Open redirect

Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes...

CVE-2018-15717

Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes...

CVE-2018-15717

Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes...

PT-2018-13167

Name of the Vulnerable Software and Affected Versions Open Dental versions prior to 18.4 Description The issue concerns the storage of user passwords in a insecure manner, specifically as base64 encoded MD5 hashes. Recommendations For versions prior to 18.4, update to version 18.4 or later to...

CVE-2018-15717: Use of Password Hash With Insufficient Computational Effort

Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes...

Design/Logic Flaw

GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...

CVE-2018-19329

GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...