ImgHosting 1.5 - Cross-Site Scripting

ImgHosting 1.5 - Cross-Site Scripting Exploit Title: ImgHosting Image Storage System 1.5 - Cross-Site-Scripting Date: 12-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: foxsash.com Version: 1.5 CVE-ID: CVE-2018-5479 ImgHosting – Image Storag...

Authentication flaw

Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code via the sgcgoogleanalytic parameter that runs on all pages served by WordPress. The saveGoogleCode function in...

CVE-2018-3810

Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code via the sgcgoogleanalytic parameter that runs on all pages served by WordPress. The saveGoogleCode function in...

Schneider Electric Pelco VideoXpert Enterprise Elevation of Privilege Vulnerability

Pelco VideoXpert Enterprise is an enterprise video management system. An elevation of privilege vulnerability exists in Schneider Electric Pelco VideoXpert Enterprise, where an attacker can gain system privileges by replacing certain files and inserting code that will execute with the elevated...

Code execution vulnerability in OpenSNS backend AuthorizeController.class.php page

OpenSNS is a lightweight social user center framework based on OneThink. The system upholds a minimalist design style and focuses on communication. A code execution vulnerability exists in the AuthorizeController.class.php page in the OpenSNS backend. Allow attackers to exploit the vulnerability ...

Foxit Reader xfascriptobject Insertion Obfuscation Remote Code Execution Vulnerability

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. A remote code execution vulnerability exists in the insert method of the XFAScriptObject object in Foxit Reader version 8.3.1.21155, which is caused by the program not properly validating user-submitted data. A remot...

CVE-2017-1433

IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow an authenticated user to insert messages with a corrupt RFH header into the channel which would cause it to restart. IBM X-Force ID: 127803...

Razer US: XSS on Saved Carts page

The saved cart endpoint was vulnerable to a reflective XSS due to lack of sanitization of cartcode which is inserted back in the HTML document, which could allow execution of malicious Javascript on the client...

CVE-2017-14019

An Unquoted Search Path or Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An unquoted search path or element vulnerability has been identified, which may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate his or her...

Oracle E-Business Suite Unauthorized Operation Vulnerability (CNVD-2017-32191)

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. The software provides customer relationship management, service management, financial management, etc. Oracle Interaction Center Intelligence is one o...

Unspecified Vulnerability in Oracle Knowledge Management Component (CNVD-2017-31059)

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. The software provides customer relationship management, service management, financial management, etc. Oracle Knowledge Management is one of the...

CVE-2017-1000102

The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to these plugins, for example the console output which is parsed to extract build warnings Warnings Plugin, could insert...

CVE-2017-1002006

Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/savecontact.php doesn't check that the user is authorized before injecting new contacts into the wpcontact table...

NethServer 7.3.1611 - Cross-Site Request Forgery Cross-Site Scripting

NethServer 7.3.1611 - Cross-Site Request Forgery Cross-Site Scripting NethServer 7.3.1611 Upload.json CSRF Script Insertion Vulnerability Vendor: NethServer.org Product web page: https://www.nethserver.org Affected version: 7.3.1611-u1-x8664 Summary: NethServer is an operating system for the Linu...

NethServer 7.3.1611 Upload.json CSRF Script Insertion

NethServer 7.3.1611 Upload.json CSRF Script Insertion Vulnerability Vendor: NethServer.org Product web page: https://www.nethserver.org Affected version: 7.3.1611-u1-x8664 Summary: NethServer is an operating system for the Linux enthusiast, designed for small offices and medium enterprises. It's...

Oracle iStore Remote Vulnerability (CNVD-2017-26818)

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. Oracle iStore is one of the ability to allow merchant...

Oracle Enterprise Repository Unauthorized Operation Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is the United States Oracle Oracle company's set of business innovation platform for enterprise and cloud environments, the platform provides middleware, software collection and other functions. enterprise Repository is one of the data storage...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2017-15376)

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. The software provides customer relationship management, service management, financial management, etc. Oracle One-to-One Fulfillment is one of the...

Code Execution Vulnerability in FineCMS v5.0.8 Public Interest Edition Backend

FineCMS v5.0.8 is a cms for small and medium-sized websites developed by SkyRay programming team. FineCMS v5.0.8 public welfare version of the background there is a code execution vulnerability, remote attackers can take advantage of the vulnerability to insert code, and the code can be parsed...

CVE-2017-9832

An integer overflow vulnerability in ptp-pack.c ptpunpackOPL function of libmtp version 1.1.12 and below allows attackers to cause a denial of service out-of-bounds memory access or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable...