CVE-2018-17852

A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detaillisting URI...

PT-2018-14225

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A SQL injection issue was found in the coreframe/app/coupon/admin/card.php file, specifically via the groupname parameter to the "/index.php?m=coupon&f=card&v=detail listing" API endpoint. Recommendations Fo...

PT-2018-14212

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 2.0 Description A security issue exists due to the presence of XSS in the software. The issue is related to the v or f parameter in the "index.php" endpoint. Recommendations For WUZHI CMS version 2.0, consider restricting...

CVE-2018-17832: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

PT-2018-14189

Name of the Vulnerable Software and Affected Versions PCProtect Anti-Virus version 4.8.35 Description The issue allows local users to gain privileges by replacing an executable file with a Trojan horse due to "Everyone: F" permission for %PROGRAMFILESX86%PCProtect. Recommendations For PCProtect...

PT-2018-13509

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to a form parameter in a specific page. The remark parameter in the form on the page index.php?m=link&f=index&v=add is vulnerable to XSS attacks. Recommendations For WUZHI CMS version...

PT-2018-13510

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to a form parameter in a specific PHP file, allowing for XSS attacks. The vulnerable parameter is statcode in the form on the page index.php?m=core&f=set&v=basic. Recommendations For WUZ...

CVE-2018-16350: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic formstatcode parameter...

CVE-2018-16231

Michael Roth Software Personal FTP Server PFTP through 8.4f allows remote attackers to cause a denial of service daemon crash via an unspecified sequence of FTP commands...

f-w.co.jp XSS vulnerability

Open Bug Bounty ID: OBB-662546 Description| Value ---|--- Affected Website:| f-w.co.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

f-16.net XSS vulnerability

Open Bug Bounty ID: OBB-661807 Description| Value ---|--- Affected Website:| f-16.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

t-f-a.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-657675 Description| Value ---|--- Affected Website:| t-f-a.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ThreatList: Spam’s Revival is Tied to Adobe Flash’s Demise

Spam click-rates are up in 2018. Last year, 13.4 percent of spam messages that made it into inboxes were clicked on. So far, in 2018 that percentage has jumped to 14.2 percent. The numbers come from F-Secure, which reported Wednesday on the sorry state of users’ better judgment when it comes to...

PT-2018-12559

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A SQL injection issue was found that allows remote attackers to inject malicious SQL statements via the "index.php?m=promote&f=index&v=search keywords" parameter. Recommendations For WUZHI CMS version 4.1.0,...

PT-2018-12557

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A persistent XSS issue was found, allowing remote attackers to inject arbitrary web script or HTML via the formcontent parameter to the "index.php?m=feedback&f=index&v=contact" API endpoint. Recommendations...

CVE-2018-14513: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formcontent parameter to the index.php?m=feedback&f=index&v=contact URI...

CVE-2018-13034: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in Jester web framework 0.2.0 allows remote attackers to fetch files in arbitrary locations via "..%f" sequences...

PT-2018-3995

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 5aba5b89d0b1d73164d3b81764828bb8b20ff32a Description The issue is related to an out of array read in the ASF F format demuxer, which can result in heap memory reading. This can be exploited via a specially crafted ASF...

CVE-2018-13123

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p=rawview for the /etc/passwd file...

PT-2018-11615

Name of the Vulnerable Software and Affected Versions OneFileCMS versions prior to 2017-10-08 Description The issue allows attackers to read arbitrary files via the i and f parameters. For example, the "/etc/passwd" file can be accessed using the endpoint "?i=etc/&f=passwd&p=raw view"...