Mail.ru: XSS ( Работа с письмами )

Заходим в почту. 2. Настройки - Работа с письмами. Получаем GET запросом входящие параметры...

Ubiquiti Inc.: Reflected XSS

Due to the lack of sanitisation in the commend area, with a especially crafted message, is possible to execute a XSS with the "preview" function. If a draft is save, is possible to exploit this bug using as and stored-XSS. The "New Discussion" page on the Spanish and Portuguese forums have a...

WordPress Z-URL Preview plugin <= 1.6.2 - Cross-Site Scripting (XSS) vulnerability

A Cross-Site Scripting XSS vulnerability found by Neorichi in WordPress Z-URL Preview plugin versions = 1.6.2. Vulnerable to Cross-Site Scripting via the class.zlinkpreview.php url parameter. Solution Update the WordPress Z-URL Preview plugin to the latest available version at least 2.0.0...

WordPress Z-URL Preview Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site. z-URL Preview plugin is used in one of the external links to get the plugin . A cross-site scripting vulnerability...

Design/Logic Flaw

Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration...

CVE-2017-1000491

CVE-2017-1000491 affects the Shiba markdown live preview app, version 1.1.0, with a cross-site scripting (XSS) vulnerability that can lead to code execution. The root cause is enabled Node.js integration in the app environment. Exploit specifics, affected platforms, and remediation are not provid...

CVE-2017-1000491

Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration...

CVE-2017-1000491: Improper Neutralization of Input During Web Page Generation

Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration...

PT-2018-5255

Name of the Vulnerable Software and Affected Versions Shiba markdown live preview app version 1.1.0 Description The issue allows for XSS, leading to code execution due to enabled node integration. Recommendations For version 1.1.0, disable node integration to prevent code execution until a patch ...

Design/Logic Flaw

The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter...

CVE-2017-18012

The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter...

CVE-2017-18012

The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter...

CVE-2017-18012

The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter...

CVE-2017-18012

The CVE-2017-18012 entry concerns the WordPress plugin Z-URL Preview (versions up to 1.6.1/1.6.2 per sources). The vulnerability is a Cross‑Site Scripting (XSS) attack triggered through the parameter in the file class.zlinkpreview.php (the url parameter), enabling script injection in affected pag...

PT-2018-6608

Name of the Vulnerable Software and Affected Versions: Z-URL Preview plugin version 1.6.1 Description: The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the url parameter in the class.zlinkpreview.php file. Recommendations: For Z-URL...

CVE-2017-18012: Improper Neutralization of Input During Web Page Generation

The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter...

Session fixation

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503...

CVE-2016-10704

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503...

CVE-2016-10704: Improper Neutralization of Input During Web Page Generation

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503...

Synology Chat Server-Side Request Forgery Vulnerability (CNVD-2018-01480)

Synology Chat is an enterprise messaging service that runs on Synology NAS. The solution eliminates the need for users to compose emails and improves the efficiency of corporate communication. A server-side request forgery vulnerability exists in Link Preview in Synology Chat. A remote...