CVE-2017-1000491

CVE-2017-1000491 affects the Shiba markdown live preview app, version 1.1.0, with a cross-site scripting (XSS) vulnerability that can lead to code execution. The root cause is enabled Node.js integration in the app environment. Exploit specifics, affected platforms, and remediation are not provid...

CVE-2017-18012

The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter...

Design/Logic Flaw

The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter...

CVE-2017-18012

The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter...

CVE-2017-18012

The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter...

CVE-2017-18012

The CVE-2017-18012 entry concerns the WordPress plugin Z-URL Preview (versions up to 1.6.1/1.6.2 per sources). The vulnerability is a Cross‑Site Scripting (XSS) attack triggered through the parameter in the file class.zlinkpreview.php (the url parameter), enabling script injection in affected pag...

CVE-2016-10704

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503...

Session fixation

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503...

Vanguard Marketplace Digital Products PHP Arbitrary File Upload Vulnerability

Vanguard Marketplace Digital Products PHP is a set of PHP-based scripts for online trading sites for MP3 and other digital files. A security vulnerability exists in Vanguard Marketplace Digital Products PHP version 1.4. The vulnerability can be exploited to upload arbitrary files via the Add New...

Synology Chat Server-Side Request Forgery Vulnerability (CNVD-2018-01480)

Synology Chat is an enterprise messaging service that runs on Synology NAS. The solution eliminates the need for users to compose emails and improves the efficiency of corporate communication. A server-side request forgery vulnerability exists in Link Preview in Synology Chat. A remote...

CVE-2017-15886

Server-side request forgery SSRF vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI...

CVE-2017-15886

Server-side request forgery SSRF vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI...

CVE-2017-15886

The CVE-2017-15886 vulnerability affects Synology Chat’s Link Preview component and is triggered by an authenticated user via a crafted URI to perform server‑side request forgery (SSRF). The issue allows downloading arbitrary local files on the server when exploiting Link Preview on Synology Chat...

CVE-2017-15886

Server-side request forgery SSRF vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI...

CVE-2017-17874

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

The vulnerability of the Print Preview function in Google Chrome browsers allows a hacker to gain access to memory beyond the boundaries of the application.

The vulnerability of the Print Preview function in Google Chrome browsers relates to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to memory beyond the boundaries of the application through a specially crafted...

Buffer overflow

WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service buffer overflow or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function in WTF/wtf/FastBitVector.cpp f...

CVE-2017-17821

WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service buffer overflow or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function in WTF/wtf/FastBitVector.cpp f...

DEBIAN-CVE-2017-17821

WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service buffer overflow or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function in WTF/wtf/FastBitVector.cpp f...

CVE-2017-17821

WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service buffer overflow or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function in WTF/wtf/FastBitVector.cpp f...