CVE-2011-3642

Cross-site scripting XSS vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system news extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin...

CVE-2011-3642

Cross-site scripting XSS vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system news extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin...

CVE-2011-3642

Summary : CVE-2011-3642 is an XSS flaw in Flowplayer Flash (versions 3.2.7–3.2.16) used by the TYPO3 News system extension (and Mahara). An attacker can inject arbitrary script/HTML via the plugin configuration directive that references an external domain plugin, potentially compromising site use...

PT-2020-7129

Name of the Vulnerable Software and Affected Versions Flowplayer Flash versions 3.2.7 through 3.2.16 Description The issue allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin, which can lead to cross-sit...

CVE-2020-8091

svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname...

CVE-2019-19823

A certain router administration interface that includes Realtek APMIB 0.11f for Boa 0.94.14rc21 stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4....

CVE-2019-19823

A certain router administration interface that includes Realtek APMIB 0.11f for Boa 0.94.14rc21 stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4....

Design/Logic Flaw

A certain router administration interface that includes Realtek APMIB 0.11f for Boa 0.94.14rc21 stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4....

CVE-2019-19823

A certain router administration interface that includes Realtek APMIB 0.11f for Boa 0.94.14rc21 stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4....

CVE-2019-19823

CVE-2019-19823 affects Realtek SDK-based routers (Boa 0.94.14rc21) used by TOTOLINK, Sapido, CIK Telecom, Fibergate, and others. The issue allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, by accessing the config.dat/file storage...

CVE-2019-19823: Insufficiently Protected Credentials

A certain router administration interface that includes Realtek APMIB 0.11f for Boa 0.94.14rc21 stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4....

Shlayer, No. 1 Threat for Mac, Targets YouTube, Wikipedia

The malvertising-focused trojan known as Shlayer has burbled to the top of the malware heap when it comes to targeting Mac users. It made up 29 percent of all attacks on macOS devices in Kaspersky’s telemetry for 2019, making it the No. 1 Mac malware threat for the year. To spread, it has been...

Ansible: malicious code could craft filename in nxos_file_copy module

A vulnerability in Ansible's nxosfilecopy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues...

SWFPFinder - SWF Potential Parameters Finder

SWFPFinder is a simple and open source bash script designed to discovery the potential swf file parameters on the webapp analysing the swf file. SWFPFinder use swfmill tool, swfmill is a tool to process Adobe Flash SWF files. It can convert SWF from and to an XML dialect called “swfml”, which is...

CVE-2014-4553

Cross-site Scripting XSS in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters...

Cross site scripting

Cross-site Scripting XSS in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters...

CVE-2014-4553

CVE-2014-4553 concerns Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin for WordPress (2014). The vulnerability is described as allowing remote attackers to execute arbitrary web script or HTML via unspecified parameters. The connected documents confirm the affected ...

PT-2020-7676

Name of the Vulnerable Software and Affected Versions spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress Description The issue allows remote attackers to execute arbitrary web script or HTML via unspecified parameters, which can lead to Cross-site Scripting XSS attacks. Recommendatio...

CVE-2014-4553: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters...

Stripo Inc: csrf bypass using flash file + 307 redirect method at plugins endpoint

Hi Security team, i have found that the request sent to https://my.stripo.email/cabinet/stripeapi/v1/plugin/$userid$/plugins don't have any protection against csrf attacks as the server only validates that the content type is application/json and this can be bypassed using the flash file + 307...