CVE-2015-8602

The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token, which embeds a rendered...

Code injection

The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token, which embeds a rendered...

CVE-2015-8602

The CVE-2015-8602 issue affects the Drupal Token Insert Entity module (7.x-1.x) prior to 7.x-1.1. The vulnerability arises from improper permission checks that let remote authenticated users with certain permissions bypass access restrictions and insert a token that embeds a rendered entity into ...

CVE-2015-8602

The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token, which embeds a rendered...

CVE-2015-8084

CVE-2015-8084 affects Huawei USG5500, USG2100, USG2200, and USG5100 unified security gateways with software prior to V300R001C10SPC600. When DHCP Snooping is enabled and option82 insert or option82 rebuild is active on an interface, devices fail to parse certain DHCP packets, enabling remote atta...

Google Chrome Blink Same-Origin Policy Bypass Vulnerability (CNVD-2015-06769)

Google Chrome is an open source WEB browser. The 'ContainerNode::parserInsertBefore' function in the core/dom/ContainerNode.cpp file in Blink used by Google Chrome has a security vulnerability that can be exploited by a remote attacker to bypass the same-origin policy, as a program still performs...

UBUNTU-CVE-2015-3863

Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation, aka internal bug 22802399...

Updated mysql-connector-java package fixes security vulnerability

Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some MySQL Connectors accessible data as well as read access to a subset of MySQL...

Shopify: SSRF via 'Insert Image' feature of Products/Collections/Frontpage

Hi Security team, I would like to report an another SSRF issue like my previous bug 67377 https://hackerone.com/reports/67377. The description, threats, risks, exploatations are the same. The base request is the following POST /admin/settings/files.json HTTP/1.1 Host: test-4925.myshopify.com...

php: NULL pointer dereference in pgsql extension

A NULL pointer dereference flaw was found in PHP's pgsql extension. A specially crafted table name passed to a function such as pginsert or pgselect could cause a PHP application to crash...

CVE-2015-0986

Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey 1 set or 2 get command...

Design/Logic Flaw

core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask...

Simple Invoice 2011.1 Cross Site Request Forgery

Affected software: simple invoice Type of vulnerability:adding admin user via csrf URL:simpleinvoices.org Discovered by: provensec Website: provensec.com version:2011.1 Proof of concept...

Agilent Technologies Feature Extraction AnnotationX.AnnList.1 ActiveX Control Arbitrary Code Execution Vulnerability

Agilent Technologies Feature Extraction is a set of feature extraction software for automatically reading and processing image files from multiple original chips from Agilent Technologies. A security vulnerability exists in Agilent Technologies Feature Extraction's AnnotationX.AnnList.1 ActiveX...

CVE-2015-2092

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

嘉缘人才系统sql注入#3

简要描述： 求20rank 详细说明： 首先看到frcms\member\requireslist.php if$do=="savedata" if$POST'id'=="" $POST'sid'=intval$Memberid; $POST'member'=getcookie'userlogin'; $POST'school'=getcookie'username'; ifempty$POST'title' showmsg'标题不能为空！','-1';exit; $POST'adddate'=date'Y-m-d H:i:s';...

(0Day) Agilent Technologies Feature Extraction ActiveX Control Index Out-Of-Bounds Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Agilent Technologies Feature Extraction. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the INSERT page in Cisco Prime Infrastructure PI allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868...

CVE-2014-2152

Cisco Prime Infrastructure (PI) contains a Cross-Site Request Forgery (CSRF) vulnerability on the INSERT page that could allow an unauthenticated/remote attacker to hijack the authentication of an authenticated PI user and perform actions on behalf of that user. Root cause is insufficient CSRF pr...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter in a search request, 2 username in a login request, which is not properly handled when logging the event, or 3 page titl...