CVE-2017-14048

BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted newmodulename parameter to backend/addons/ajaxcreate.php. NOTE: this can be exploited via CSRF...

CVE-2017-14048

BlackCat CMS 1.2 is affected. Remote authenticated users can inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php, enabling code execution. The issue is also exploitable via CSRF; root cause is insufficient validation in ajax_create.php....

Cross site scripting

Cross-site scripting XSS vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment...

SAP NetWeaver Visual Composer Remote Code Injection Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A remote code injection vulnerability exists in SAP NetWeaver Visual Composer. An attacker could exploit the...

CVE-2017-6782

Cisco Prime Infrastructure (CPI) HTML Injection vulnerability CVE-2017-6782 allows an authenticated remote attacker to modify a page in the CPI administrative web interface due to improper sanitization of parameter values. Attack chain involves injecting code into an affected parameter and entici...

IBM Curam Social Program Management Remote Code Injection Vulnerability

IBM Curam Social Program Management SPM is a suite of social program management solutions from IBM USA. The solution supports the process of end-to-end social program delivery. A remote code injection vulnerability exists in IBM Curam SPM. An attacker could exploit this vulnerability to inject or...

CVE-2015-2690

CVE-2015-2690 affects FreePBX Digium Addons (digiumaddoninstaller) before 2.11.0.7. Multiple XSS flaws exist in views/add-license-form.php invoked via admin/config.php (type=setup, display=digiumaddons, page=add-license-form, addon=ffa). The attacker can inject script/HTML through any of 12 param...

CVE-2017-2285

The CVE affects WordPress plugin Simple Custom CSS and JS prior to version 3.4. A reflected cross-site scripting (CWE-79) vulnerability allows an attacker to inject arbitrary script, potentially executing in a logged-in user’s browser. The exact attack vectors aren’t specified in the provided doc...

CVE-2017-11460

CVE-2017-11460 is a cross-site scripting (XSS) vulnerability in the DataArchivingService servlet of SAP NetWeaver Portal 7.4. The issue allows remote attackers to inject arbitrary web script or HTML by manipulating the responsecode parameter in shp/shp_result.jsp. Public sources consistently desc...

SUSE-SU-2017:1893-1 Security update for evince

This update for evince fixes the following issues: - CVE-2017-1000083: Remote attackers could have used the comicbook mode of evince to inject shell code. bsc1046856, bgo784630...

SUSE-SU-2017:1894-1 Security update for evince

This update for evince fixes the following issues: - CVE-2017-1000083: Remote attackers could have used the comicbook mode of evince to inject shell code. bsc1046856, bgo784630...

CVE-2017-1000032

Cross-Site scripting XSS vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parentid parameter to tree.php and drpaction parameter to datasources.php...

SAP GRC Remote Code Injection Vulnerability

SAP GRC is a suite of governance, risk management and compliance solutions from SAP Germany. SAP GRC suffers from a remote code injection vulnerability. It allows an attacker to inject arbitrary code...

Cross-site scripting vulnerability in phpLDAPadmin htdocs/entry_chooser.php file

phpLDAPadmin is a web-based LDAP client that allows easy management of LDAP servers. A cross-site scripting vulnerability exists in the htdocs/entrychooser.php file in phpLDAPadmin 1.2.3 and earlier versions. A remote attacker can inject code with the help of the 'form', 'element', 'rdn' or...

The vulnerability of the software interface of the Android operating system’s Framework, allowing a hacker to inject arbitrary code

The vulnerability of the software interface of the Android operating system’s Framework is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely, using a local malware application...

The vulnerability of the software interface of the Android operating system’s Framework, allowing a hacker to inject arbitrary code

The vulnerability of the software interface of the Android operating system’s Framework is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely, using a local malicious application...

The vulnerability of the nscd library, which provides system calls and core functions of glibc, allows a perpetrator to cause a service failure or implement malicious code.

The vulnerability of the nscd library, which provides system calls and core functions of the glibc library, arises due to incorrect reading of the internal buffer size. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures or inject code by running the...

Code injection

libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service stack consumption via a crafted rule involving hex strings that is mishandled in the yrreemit function, a different vulnerability than CVE-2017-9304...

Cross site scripting

Cross-site scripting XSS vulnerability in FlipBuilder Flip PDF allows remote attackers to inject arbitrary web script or HTML via the currentHTMLURL parameter...

Logsign Remote Code Injection Vulnerability

Logsign is the next generation security information and event management solution for security intelligence, log management and easy compliance reporting. Logsign suffers from a remote code injection vulnerability. An attacker could exploit this vulnerability to execute arbitrary script code with...