6885 matches found
PT-2020-21044
Name of the Vulnerable Software and Affected Versions xoc version 1.0.7 Description The issue concerns malicious code in version 1.0.7 of the xoc module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the extracted valu...
UltraRank hackers compromised 100s of websites via JS-Sniffer attacks
By Zara Khan The cybercriminal group dubbed as “UltraRank’ previous shenanigans were linked to Magecart Groups 2, 5, and 12. This is a post from HackRead.com Read the original post: UltraRank hackers compromised 100s of websites via JS-Sniffer attacks...
Arbtirary Code Execution
grunt is vulnerable to arbitrary code execution. The library uses an insecure .load function from js-yaml by default and allows an attacker to inject and execute arbitrary code...
Cross site request forgery (csrf)
php/qmnoptionsquestionstab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the questionname parameter because js/adminquestion.js mishandles parsing inside of a SCRIPT element...
CVE-2016-11085
php/qmnoptionsquestionstab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the questionname parameter because js/adminquestion.js mishandles parsing inside of a SCRIPT element...
CVE-2016-11085: Improper Neutralization of Input During Web Page Generation
php/qmnoptionsquestionstab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the questionname parameter because js/adminquestion.js mishandles parsing inside of a SCRIPT element...
PT-2020-8014
Name of the Vulnerable Software and Affected Versions: Quiz-master-next plugin versions prior to 4.7.9 for WordPress Description: The issue allows for Cross-Site Request Forgery CSRF with resultant stored Cross-Site Scripting XSS via the question name parameter. This occurs because the js/admin...
@cloudron/manifest-format (>=5.27.0, <=5.35.0), @cloudron/pipework (>=1.1.0, <=2.0.0) +13 more potentially affected by CVE-2020-7737 via safetydance (>=0.0.15, <=2.5.1)
safetydance NPM version =0.0.15, =5.27.0, =1.1.0, =1.0.0, =0.1.2, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =0.8.7, =1.3.0, =0.0.3, =0.0.2, =0.2.1 Source cves: CVE-2020-7737 Source advisory: SNYK:JS-SAFETYDANCE-598687...
@arkecosystem/core-new-relic (>=2.6.0-next.4, <=2.7.26), @beyounglabs/alfred (>=0.0.3, <=3.0.16) +62 more potentially affected by CVE-2020-7768 via @grpc/grpc-js (>=1.0.0, <=1.1.7)
@grpc/grpc-js NPM version =1.0.0, =2.6.0-next.4, =0.0.3, =0.1.4, =1.12.0, =0.7.1, =0.7.4, =0.7.2, =4.4.3-dev.21, =1.6.0-rc, =0.1.14-alpha-71502f6.0, =0.1.1-alpha.0, =0.0.2, =0.1.9, =2.9.0-alpha.0, =3.3.0 - @irvingjs/vip-go 3.0.0-alpha.16 and more Source cves: CVE-2020-7768 Source advisory:...
PT-2020-14219 · Mybb · Mybb
Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.24 Description: The issue arises from improper input escaping in the custom MyCode for the visual editor, leading to a DOM-based XSS vulnerability. This can be exploited by directing a victim to a page with the visu...
CWFF - Create Your Custom Wordlist For Fuzzing
CWFF is a tool that creates a special High quality fuzzing/content discovery wordlist for you at the highest speed possible using concurrency and it's heavily inspired by @tomnomnom's Who, What, Where, When, Wordlist NahamCon2020. Usage CWFF -h --threads --github --subdomains --recursive...
The vulnerability in the implementation of the TLS protocol on the Node.js software platform allows a attacker to execute a type of “man-in-the-middle” attack.
The vulnerability of the Node.js software platform’s TLS protocol lies in the shortcomings of certificate authenticity verification. Exploiting this vulnerability allows a malicious actor to execute a type of “man-in-the-middle” attack...
Arbitrary Code Execution
Overview shiba is a Live markdown previewer with linter Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad. Remediation There is no fixed version for shiba...
Uncontrolled resource consumption in jpeg-js
Uncontrolled resource consumption in jpeg-js before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image...
08cms (1.0.0), 18a58t9c-upload (>=1.0.0, <=1.0.3) +3426 more potentially affected by CVE-2020-8175 via jpeg-js (>=0.0.1, <=0.3.7)
jpeg-js NPM version =0.0.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =0.0.2, =0.0.1, =0.0.3, =1.0.0-alpha.19, =0.0.2, =2.2.1, =3.4.7 - @lan/uni-libs 0.0.3 and more Source cves: CVE-2020-8175 Source advisory: OSV:GHSA-W7Q9-P3JQ-FMHM...
GHSA-W7Q9-P3JQ-FMHM Uncontrolled resource consumption in jpeg-js
Uncontrolled resource consumption in jpeg-js before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image...
HawkScan - Security Tool For Reconnaissance And Information Gathering On A Website
Security Tool for Reconnaissance and Information Gathering on a website. python 2.x & 3.x This script use "WafW00f" to detect the WAF in the first step https://github.com/EnableSecurity/wafw00f This script use "Sublist3r" to scan subdomains https://github.com/aboul3la/Sublist3r This script use...
CVE-2020-8175
Uncontrolled resource consumption in jpeg-js before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image...
