3445 matches found
Regular Expression Denial of Service
Overview Affected versions of string are vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods. Recommendation There is currently no direct patch for this vulnerability. Currently, the best solution ...
CVE-2017-14596
creationtimestamp| type| source ---|---|--- 2017-09-20 19:26:21+00:00| published-proof-of-concept| https://t.me/canyoupwnme/2338...
Scripting Engine Information Disclosure Vulnerability
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. In a web-based attack scenario, an...
pwn-hisilicon-dvr
It is an offensive tool for embedded systems. This repository co...
Race condition
In all Qualcomm products with Android releases from CAF using the Linux kernel, in function mdssfbcopydestscalerdata, variable dsdatai.scale may still point to a user-provided address which could point to arbitrary kernel address, so on an error condition, this user-provided address will be freed...
Scripting Engine Information Disclosure Vulnerability
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. In a web-based attack scenario, an...
Microsoft Edge based on Edge HTML Information Disclosure Vulnerability
An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit the vulnerability, in a web-based attac...
CVE-2017-1000059
Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users...
CVE-2017-1000059
Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users...
HPE Intelligent Management Center dbman BackupZipFile Command Injection (CVE-2017-5820)
A command injection vulnerability exist in the dbman component of HPE Intelligent Management Center. The vulnerability is due to missing validation of user-provided parameters when handling BackupZipFile commands. A remote, unauthenticated attacker can exploit the vulnerability by sending a...
WordPress WP Statistics plugin <=12.0.7 - Authenticated SQL Injection vulnerability
WordPress WP Statistic plugin in version 12.0.7 and earlier versions vulnerable to Authenticated SQL Injection vulnerability due to lack of sanitization in user-provided data. In this case users even with subscriber rights could use this vulnerability to steal sensitive data. Solution The plugin...
CVE-2017-6982
creationtimestamp| type| source ---|---|--- 2017-05-17 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42014...
CVE-2016-5006
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors...
Information disclosure
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors...
CVE-2016-5006
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors...
Cross-site Scripting (XSS)
Apache Hadoop HDFS is susceptible to cross-site scripting XSS attacks. The attacks are possible because it does not sanitize the user-provided input properly, allowing XSS attacks...
Dropbox: avrecode: global-buffer-overflow in get_neighbor()
Source: https://github.com/dropbox/avrecode Version: 2de743d Built using the Github instructions with afl-gcc and ASAN. Feeding this malformed .mp4 to recode triggers a global buffer overflow. ./recode roundtrip test003.mp4 mov,mp4,m4a,3gp,3g2,mj2 @ 0x61b00001f180 Protocol name not provided, cann...
Cisco WebEx Meetings Server Arbitrary Password Change Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct arbitrary password changes against any non-administrative user. The vulnerability is due to insufficient parameter string security. An attacker could exploit this vulnerability by creating a...
Microsoft Browser Information Disclosure Vulnerability
An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit the vulnerability, in a web-based attack...