3058 matches found
CVE-2016-5204
CVE-2016-5204 affects Chromium-based browsers (Blink SVG image handling). The issue is a cross-site scripting (UXSS) vulnerability caused by SVG shadow DOM handling that can allow script/HTML injection via crafted pages. Desktop/chromium versions prior to 55.0.2883.75 (desktop) and 55.0.2883.84 (...
BlackBoard LMS 9.1 SP14 - (Title) Persistent Vulnerability
Document Title: =============== BlackBoard LMS 9.1 SP14 - Title Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1901 Release Date: ============= 2017-01-10 Vulnerability Laboratory ID VL-ID: ====================================...
Blackboard LMS 9.1 SP14 - (Profile) Persistent Vulnerability
Document Title: =============== Blackboard LMS 9.1 SP14 - Profile Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1900 Release Date: ============= 2017-01-09 Vulnerability Laboratory ID VL-ID: ====================================...
Cross site scripting
Cross-site scripting XSS vulnerability in the Inbox Search feature in Hybris Management Console HMC in SAP Hybris before 6.0 allows remote attackers to inject arbitrary web script or HTML via the itemsperpage parameter...
CVE-2016-7954
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334...
CVE-2016-7954
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334...
CVE-2016-7954
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334...
CVE-2016-7954
CVE-2016-7954 affects Bundler 1.x, where a gem name collision on a secondary source can enable remote code execution in a Ruby application. The issue arises from multiple top-level source lines allowing a malicious gem with the same name as a legitimate gem to be pulled from a different source, a...
CVE-2016-7954
Removed by vendor...
KLA10914 Multiple vulnerabilities in Google Chrome
Multiple serious vulnerabilities have been found in Google Chrome prior to 54.0.2840.59. Malicious users can exploit these vulnerabilities to bypass security restrictions, spoof user interface, inject code or possibly cause denial of service. Below is a complete list of vulnerabilities: 1. Missed...
PHP FormMail Generator Security Bypass Vulnerability (CNVD-2016-12386)
PHP FormMail Generator is a suite of PHP applications for generating standard web forms for inclusion in PHP or WordPress websites. A security bypass vulnerability exists in PHP FormMail Generator. A remote attacker can exploit this vulnerability to inject PHP code or perform unauthorized...
CVE-2016-9751
Cross-site scripting XSS vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter...
CVE-2016-6461
CVE-2016-6461 affects Cisco ASA: a vulnerability in the HTTP web-based management interface could allow an unauthenticated, remote attacker to inject arbitrary XML commands via improperly validated XML input. Affected release mentioned: 9.1(6.10). Recommended fixed releases (per sources): 100.11(...
Trend Micro Smart Protection Server Exec Remote Code Injection
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'openssl' require 'base64' class MetasploitModule "Trend Micro Smart Protection Server Exec Remote Code Injection", 'Description' = %q This...
CVE-2016-9188
Cross-site scripting XSS vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the sadditionalhtmlhead, sadditionalhtmltopofbody, and sadditionalhtmlfooter parameters...
CVE-2016-7954
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334...
PT-2016-15: Cross-Site Scripting in SAP NetWeaver
The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in SAP NetWeaver. Reflected cross-site scripting in the "/com.sap.portal.design.datamigration.LogPortalComponen" component allows remote attackers to inject arbitrary HTML tags including JavaScript...
CVE-2016-7125
ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection...
CVE-2016-7125
ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection...