CVE-2017-6560

XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=misc&action=XSS&editObjId=XSS attack...

CVE-2017-5157

An issue was discovered in Schneider Electric homeLYnk Controller, LSS100100, all versions prior to V1.5.0. The homeLYnk controller is susceptible to a cross-site scripting attack. User inputs can be manipulated to cause execution of JavaScript code...

Ansible: Compromised remote hosts can lead to running commands on the Ansible controller

An input validation vulnerability was found in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server...

CVE-2016-10006

In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input a tag that supports style with active content, you could bypass the library protections and supply executable code. The impact is XSS...

Edusson (Robotdon) BB - Bypass & Persistent Vulnerability

Document Title: =============== Edusson Robotdon BB - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1870 Release Date: ============= 2016-11-03 Vulnerability Laboratory ID VL-ID: ==================================== 18...

Edusson (Robotdon) BB - Bypass & Persistent Vulnerability

Document Title: =============== Edusson Robotdon BB - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1870 Release Date: ============= 2016-11-03 Vulnerability Laboratory ID VL-ID: ==================================== 18...

CVE-2016-8617

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPTUSERNAME...

Out-of-bounds

The idnatoascii4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via 64 bytes of input...

Cross-Site Scripting

Overview Affected versions of backbone are vulnerable to cross-site scripting when users are allowed to supply input to the ModelEscape function, and the output is then written to the DOM. The vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take...

Getdpd BB #3 - Persistent Cross Site Scripting Vulnerability

Document Title: =============== Getdpd BB 3 - Persistent Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1567 ID: 14771 Release Date: ============= 2016-02-03 Vulnerability Laboratory ID VL-ID:...

PHP Kobo Photo Gallery CMS for PC/smartphone and feature phone Cross Site Scripting Vulnerability

PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone is a photo gallery content management system CMS for PC, smartphone and feature phone from PHP Kobo Japan. A cross-site scripting vulnerability exists in the jquery.lightbox-0.5.min.js file in PHP Kobo Photo Gallery CMS for PC,...

Input validation

Cisco NX-OS 6.02 and 6.22 on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127...

Acoustica Pianissimo 1.0 Build 12 Buffer Overflow

Acoustica Pianissimo 1.0 Build 12 Registration ID Buffer Overflow PoC Vendor: Acoustica, Inc. Product web page: http://www.acoustica.com Affected version: 1.0 Build 12 Summary: Pianissimo virtual piano uses a combination of sample playback and advanced physical modeling to create a stunning...

ICS-CERT Advisory Warns of Schneider, Emerson Vulnerabilities

Industrial HMI software from Schneider Electric has been updated to patch a buffer overflow vulnerability that could be exploited by a remote attacker. The buffer overflow vulnerability was found in the Wonderware InTouch Access Anywhere Server v10.6 and v11. The server is human machine interface...

Active Auction House ItemInfo.ASP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13034/info Active Auction House is reportedly affected by a SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in a SQL query. Successfu...

DEBIAN-CVE-2012-6638

The tcprcvstateprocess function in net/ipv4/tcpinput.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service kernel resource consumption via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663...

Active Perl Denial of Service Vulnerability (Windows)

The host is installed with Active Perl and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbactiveperldosvulnwin.nasl 6093 2017-05-10 09:03:18Z teissa $ Active Perl Denial of Service Vulnerability Windows Authors: Arun Kallavi Copyright: Copyright c 2013 Greenbone...

CVE-2013-2633

Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive information by leveraging the logging of parameters...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web console in Plixer Scrutinizer aka Dell SonicWALL Scrutinizer before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via 1 the query string to d4d/exporters.php, 2 the HTTP Referer header to d4d/exporters.php, or 3...

eventum issue tracking system 2.3.1 - Persistent Cross-Site Scripting

eventum issue tracking system 2.3.1 - Persistent Cross-Site Scripting Exploit Title: Eventum 2.3.1 stored XSS Date: 19-2-2011 Author: Saif El-Sherei Software Link: https://code.launchpad.net/eventum Version: Eventum 2.3.1 Tested on: FF 3.0.15, IE 8 Vendor notification: vendor notified, awaiting...