2873 matches found
Cross site request forgery (csrf)
A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modify any files in any hosting account...
CVE-2018-7308
CVE-2018-7308 affects DanWin hosting (var/www/html/files.php) up to 2018-02-11. The vulnerability is a cross-site request forgery (CSRF) that lets arbitrary remote users add/delete/modify files in any hosting account. Root cause is CSRF in the affected script; no exploitation details are provided...
CVE-2018-7308
A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modify any files in any hosting account...
CVE-2015-9253
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions e.g., passthru, exec, shellexec, or system with a non-blocking STDIN stream, causing this...
CVE-2015-9253
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions e.g., passthru, exec, shellexec, or system with a non-blocking STDIN stream, causing this...
CVE-2015-9253
Removed by vendor...
CVE-2015-9253
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions e.g., passthru, exec, shellexec, or system with a non-blocking STDIN stream, causing this...
How to assign VLANs to Targets created in PVS
This article explains the relationship between Networks and VLANs as it pertains to XenDesktop Hosting Units and PVS. The article also explains a workaround to be able to distribute Target Devices across desired VLANs The concept of VLAN IDs on the Hypervisor side is unknown to the XenDesktop...
Node.js third-party modules: [public] Stored XSS in filenames in directory served by public
Hi Guys, public allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript. I put https://www.npmjs.com/package/public in Weakness section - 'Where is the stored content accessible?' because it does not allowed me to open report with...
[slackware-security] Slackware 14.2 kernel
New kernel packages are available for Slackware 14.2 to mitigate the speculative side channel attack known as Spectre variant 2. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/linux-4.4.115/: Upgraded. This kernel includes full retpoline mitigation for the Spectre varian...
[slackware-security] mozilla-thunderbird
New mozilla-thunderbird packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-thunderbird-52.6.0-i586-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...
Reservo Image Hosting Detection
Product detection for Reservo Image Hosting Server. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
Reservo Image Hosting search engine cross-site scripting vulnerability
Reservo Image Hosting is a set of online image hosting scripts. search engine is one of the search engines. A cross-site scripting vulnerability exists in the search engine in Reservo Image Hosting version 1.6. A remote attacker can exploit this vulnerability by sending a malicious URL to execute...
CVE-2018-5705
Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine the t parameter to the /search URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By sending users an infected URL, code will ...
Design/Logic Flaw
Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine the t parameter to the /search URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By sending users an infected URL, code will ...
CVE-2018-5705
Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine the t parameter to the /search URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By sending users an infected URL, code will ...
CVE-2018-5705
Reservo Image Hosting 1.6 is vulnerable to cross-site scripting in the search engine (t parameter of /search). The vulnerability allows code execution via a malicious URL and can lead to session theft of users and admins due to an active login interface. PoC/exploit details are available in publi...
CVE-2018-5705
Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine the t parameter to the /search URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By sending users an infected URL, code will ...
Ruby on Rails: Path Traversal on Default Installed Rails Application (Asset Pipeline)
There is an information leak vulnerability in Sprockets. This vulnerability has been assigned the CVE identifier CVE-2018-3760. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Not affected: NONE Fixed Versions: 4.0.0.beta8, 3.7.2, 2.12.5 Impact ------ Specially crafte...
