Code injection

In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at an external URL, and visiting index.php?r=appmanage/index/onlineinstall&url=...

Debian DLA-1550-1 : drupal7 security update

It was discovered that there was a remote code execution and an external URL injection vulnerability in the Drupal content management framework. For more information, please see : https://www.drupal.org/sa-core-2018-006 For Debian 8 'Jessie', these issues have been fixed in drupal7 version...

Debian: Security Advisory (DLA-1550-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Drupal Core - Multiple Vulnerabilities - SA-CORE-2018-006

Content moderation - Moderately critical - Access bypass - Drupal 8 In some conditions, content moderation fails to check a users access to use certain transitions, leading to an access bypass. In order to fix this issue, the following changes have been made to content moderation which may have...

CVE-2018-16307

An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name containing a random string is used...

Ramco mHub - Customized SSL, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Ramco mHub published at the 'play' market has multiple vulnerabilities...

Outlook Home Page – Another Ruler Vector

Ruler has become a go to tool for us on external engagements, easily turning compromised mailbox credentials into shells. This has resulted in security being pushed forward and Microsoft responding with patches for the two vectors used in Ruler, namely rules and forms. These were patched with...

Open Redirect

WordPress is vulnerable to open redirect attacks. It is possible because the library does not properly validate the external URL in wphttpreferer in wp-admin/edit-tag-form.php and wp-admin/user-edit.php, allowing attackers to redirect users to a different website...

apis.dict.cn Open Redirect vulnerability

Open Bug Bounty ID: OBB-318863 Description| Value ---|--- Affected Website:| apis.dict.cn Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Ooredoo Tv Go - Customized SSL, External URLs, KeyStore usage vulnerabilities

HackApp vulnerability scanner discovered that application Ooredoo Tv Go published at the 'play' market has multiple vulnerabilities...

MR Recorder - Radio Streaming - External URLs, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application MR Recorder - Radio Streaming published at the 'play' market has multiple vulnerabilities...

Machine Liker - External URLs, Unsafe deleting, WebView JavaScript enabled vulnerabilities

HackApp vulnerability scanner discovered that application Machine Liker published at the 'play' market has multiple vulnerabilities...

EXIMpay - Certificates or keys found, Dangerous filesystem permissions, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application EXIMpay published at the 'play' market has multiple vulnerabilities...

Insert Viewer - Customized SSL, External URLs, KeyStore usage vulnerabilities

HackApp vulnerability scanner discovered that application Insert Viewer published at the 'play' market has multiple vulnerabilities...

eCare21 - Customized SSL, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application eCare21 published at the 'play' market has multiple vulnerabilities...

EY GlobalOne - External URLs, Native code usage, Possible privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application EY GlobalOne published at the 'play' market has multiple vulnerabilities...

MGASA-2016-0413 Updated drupal packages fix security vulnerability

Inconsistent name for term access query; information on taxonomy terms might have been disclosed to unprivileged users CVE-2016-9449. Confirmation forms allow external URLs to be injected CVE-2016-9451...

SmartPay - Dangerous filesystem permissions, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application SmartPay published at the 'play' market has multiple vulnerabilities...

FC Krasnodar - External URLs, Native code usage, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application FC Krasnodar published at the 'play' market has multiple vulnerabilities...

Tilt - Certificates or keys found, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Tilt published at the 'play' market has multiple vulnerabilities...