UBUNTU-CVE-2018-20806

Phamm aka PHP LDAP Virtual Hosting Manager 0.6.8 allows XSS via the login page the /public/main.php action parameter...

CVE-2019-9765

Blog_mini 1.0 is affected by an XSS vulnerability that arises when a comment reply author name is not properly sanitized in app/main/views.py articleDetails(), with the issue referencing app/templates/_article_comments.html. This could allow injected scripts via the author name field as part of a...

Design/Logic Flaw

Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=indexXSS value...

CVE-2019-8363

Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=indexXSS value...

CVE-2019-8363

Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=indexXSS value...

Updated radvd packages fix security vulnerability

A flaw was found in radvd. In case of misconfiguration a race condition between privsep and main thread occurs. This leads to double-free and crashing of radvd rhbz1669297...

Cross-site Scripting (XSS)

croogo is susceptible to cross-site scripting XSS attack. The vulnerability exists because it does not sanitize the value of Title field in the Main Menu page, allowing the attacker to inject malicious payload through it...

PuTTY (European Commission - DIGIT): heap-use-after-free (READ of size 8) in main()

Summary: After downloading putty-0.70-2019-01-17.53747ad.tar.gz, I compiled it on Debian 9 with Clang-8.0.0 and AddressSanitizer and while trying to extract a public key from a crafted key, I triggered a heap-use-after-free in main. Description: add more details about this vulnerability Steps To...

Denial Of Service (Dos)

httpd is vulnerable to denial of service. Whitespace characters from CDATA sections are not properly removed in the davxmlgetcdata function in main/util.c, which would allow remote attackers to crash the daemon via a malicious DAV WRITE request...

OLX: XSS - main page - search[user_id] parameter

Hi, how you doing? This is a pretty straight foward XSS in the main page. Affected parameter: searchuserid Direct Link: https://www.olx.pt/braga/?searchuserid=1zqjeu'":/1zqjeu;9, ;prompt9;&view=galleryWide Tested in updated firefox. Impact XSS allows a intruder to inject html and client side...

PT-2018-14577 · Microstrategy · Microstrategy Analytics

Name of the Vulnerable Software and Affected Versions: Microstrategy Analytics versions prior to 10.4.0026.0049 Description: The issue concerns a CSRF problem in the main.aspx file. The vendor has provided documentation for preventing CSRF attacks, but there is a disagreement on whether this issu...

DEBIAN-CVE-2018-20191

hw/rdma/vmw/pvrdmamain.c in QEMU does not implement a read operation such as uarread by analogy to uarwrite, which allows attackers to cause a denial of service NULL pointer dereference...

UBUNTU-CVE-2018-1000852

FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvcmain.c, drdynvcprocesscapabilityrequest that can result in The RDP server can read the client's memory.. This attack appear to...

DEBIAN-CVE-2018-20123

pvrdmarealize in hw/rdma/vmw/pvrdmamain.c in QEMU has a Memory leak after an initialisation error...

Design/Logic Flaw

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file...

CVE-2018-20159

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file...

CVE-2018-20017

SEMCMS 3.5 has XSS via the first text box to the SEMCMSMain.php URI...

NA300 PLC has an unauthorized operation vulnerability

The NA300 PLC is a mid-size programmable controller. An unauthorized operation vulnerability exists in the NA300 PLC. An attacker can exploit the vulnerability to remotely tamper with the MAIN program in the PLC...

Microstrategy Analytics Cross-Site Request Forgery Vulnerability

Microstrategy Analytics is a suite of enterprise data analytics platforms from Microstrategy, Inc. in the United States. The platform features data discovery, data visualization and report generation. A cross-site request forgery vulnerability exists in the main.aspx file in Microstrategy Analyti...

CVE-2018-19558

An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php...