CVE-2018-6169

Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwanted extension via a crafted HTML page...

CVE-2018-6169

CVE-2018-6169 relates to Google Chrome/Chromium where a lack of timeout on the extension install prompt allowed a remote attacker to bypass permission checks and trigger installation of a unwanted extension via a crafted HTML page. Affected software is the Chrome/Chromium extension installation f...

CVE-2018-6169

Removed by vendor...

EARCLINK ESPCMS SQL Injection Vulnerability

EARCLINK ESPCMS is a set of enterprise building system of China Honghu Erchuang Netlink Information Technology Co. A SQL injection vulnerability exists in the installpack/espcmspublic/espcmsdb.php file in the P8 version of EARCLINK ESPCMS, which can be exploited to execute arbitrary SQL commands ...

A declarative router for service workers

I'm looking for feedback on this API. It isn't yet supported in any standard or browser. In the very early days of service workers while they were still named "navigation controllers" we had the idea of a declarative router. This provided a high-level API to define the behaviour of particular...

A declarative router for service workers

I'm looking for feedback on this API. It isn't yet supported in any standard or browser. In the very early days of service workers while they were still named "navigation controllers" we had the idea of a declarative router. This provided a high-level API to define the behaviour of particular...

PT-2019-17706

Name of the Vulnerable Software and Affected Versions EARCLINK ESPCMS-P8 Description The issue concerns a SQL injection in the install pack/index.php ac=Member&at=verifyAccount endpoint, specifically in the verify key parameter. This could potentially allow an attacker to retrieve sensitive...

Typo3 CMS Static Info Tables 6.7.3 Database Disclosure

Exploit Title : Typo3 CMS Static Info Tables Extension 6.7.3 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/01/2019 Vendor Homepage : typo3.org - extensions.typo3.org/extension/staticinfotables/ Software Download Link :...

SUSE SLED15 / SLES15 Security Update : libzypp, zypper (SUSE-SU-2018:2690-1)

This update for libzypp, zypper, libsolv provides the following fixes : Security fixes in libzypp : CVE-2018-7685: PackageProvider: Validate RPMs before caching bsc1091624, bsc1088705 CVE-2017-9269: Be sure bad packages do not stay in the cache bsc1045735 Changes in libzypp: Update to version...

LFCMS Information Disclosure Vulnerability

Lei Feng TV CMS aka LFCMS is a video-on-demand system developed using PHP and MySQL. A security vulnerability exists in LFCMS version 3.8.6. An attacker can exploit the vulnerability to disclose the full path with the help of /install.php?s=/1 URI...

CVE-2018-20614

public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install//step3 URI...

CVE-2018-20614

public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install//step3 URI...

CVE-2018-20602

Lei Feng TV CMS aka LFCMS 3.8.6 allows full path disclosure via the /install.php?s=/1 URI...

CVE-2018-20614: Improper Input Validation

public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install//step3 URI...

PT-2018-15478

Name of the Vulnerable Software and Affected Versions CIM version 0.9.3 Description The issue allows remote attackers to reload the product. This can be achieved via the "public/install//step3" URI. Recommendations For CIM version 0.9.3, consider restricting access to the public/install//step3 UR...

CVE-2018-20567

An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read...

CVE-2018-14992: Undefined Security Weakness

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/USPhone/ASUSX0081:7.0/NRD90M/USPhone-14.14.1711.92-20171208:user/release-keys contains a pre-installed platform app with a package name of com.asus.dm versionCode=1510500200, versionName=1.5.0.40171122 has an exposed interface...

CVE-2018-20567: Incorrect Permission Assignment for Critical Resource

An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read...

PT-2018-12865

Name of the Vulnerable Software and Affected Versions ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US Phone/ASUS X008 1:7.0/NRD90M/US Phone-14.14.1711.92-20171208:user/release-keys Description The pre-installed platform app com.asus.dm versionCode=1510500200,...

PT-2018-15437

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in DouCo DouPHP, where the /install/index.php endpoint allows a reload of the product under certain circumstances when the install.lock file cannot be read. Recommendations For...