6015 matches found
CVE-2016-10531: Improper Neutralization of Input During Web Page Generation
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection sanitize: true to inject a javascript: URL. This flaw exists because NNanythin...
WordPress 4.7.x < 4.7.2 REST API 'id' Parameter Privilege Escalation
The WordPress application running on the remote web server is version 4.7.x prior to 4.7.2. It is, therefore, affected by a privilege escalation vulnerability in the REST API due to a failure to properly sanitize user- supplied input to the 'id' parameter when editing or deleting blog posts. An...
Signal Desktop HTML Tag Injection Variant 2
Title: Signal-desktop HTML tag injection variant 2 Date Published: 2018-05-16 Last Update: 2018-05-16 CVE Name: CVE-2018-11101 Class: Code injection Remotely Exploitable: Yes Locally Exploitable: No Vendors contacted: Signal.org Vulnerability Description: Signal-desktop is the standalone desktop...
Cross-site Scripting (XSS)
drupal/drupal is vulnerable to cross-site scripting XSS attacks. The checkPlain function doesn't properly sanitize escape characters, allowing a malicious user to inject and execute arbitrary Javascript...
MyBB Latest Posts on Profile Plugin 1.1 - Cross-Site Scripting
Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting Date: 4/20/2018 Author: 0xB9 Contact: luxorforums.com/User-0xB9 or 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=914 Version: 1.1 Tested on: Ubuntu 17.10 CVE: CVE-2018-10580 1...
MyBB Latest Posts On Profile 1.1 Cross Site Scripting
Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting Date: 4/20/2018 Author: 0xB9 Contact: luxorforums.com/User-0xB9 or 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=914 Version: 1.1 Tested on: Ubuntu 17.10 CVE: CVE-2018-10580 1...
MyBB Latest Posts on Profile Plugin 1.1 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting Author: 0xB9 Contact: luxorforums.com/User-0xB9 or 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=914 Version: 1.1 Tested on: Ubuntu...
MyBB Latest Posts on Profile Plugin 1.1 - Cross-Site Scripting
MyBB Latest Posts on Profile Plugin 1.1 - Cross-Site Scripting Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting Date: 4/20/2018 Author: 0xB9 Contact: luxorforums.com/User-0xB9 or 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=914...
CVE-2018-8149
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft...
WordPress Plugin File Upload 4.3.3 - Stored Cross-Site Scripting (PoC)
0x01 漏洞概述 Wordpress的插件WordPress File Upload v4.3.3及其以前版本在管理后台存在一处存储型xss漏洞。攻击者可以通过该漏洞执行js脚本，获取管理员cookie。 漏洞名称：WordPress Plugin File Upload 4.3.3 - Stored Cross-Site Scripting PoC 漏洞来源：https://www.exploit-db.com/exploits/44444/ CVE：CVE-2018-9844 影响组件：WordPress Plugin File Upload...
CVE-2014-1845
An unspecified setuid root helper in Enlightenment before 0.17.6 allows local users to gain privileges by leveraging failure to properly sanitize the environment...
CVE-2018-1079
pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/putfile query. If the /etc/booth directory exists, an authenticated attacker with...
UBUNTU-CVE-2018-10060
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php...
DEBIAN-CVE-2018-10060
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php...
Cross-site Scripting (XSS)
TYPO3/CMS is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the site name, allowing a malicious user to inject and execute arbitrary code through it...
IBM Virtual Security Operations Center (VSOC) Cross Site Scripting
Exploit Title: IBM Virtual Security Operations Center VSOC - Cross Site Scripting XSS Date: August 2, 2018 Portal Link: https://portal.sec.ibm.com Exploit Author: Kushal Jaisingh Contact: https://ca.linkedin.com/in/kushaljaisingh Category: WebApps, XSS 1. Description Below are the steps to...
CVE-2018-3740
A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element...
DEBIAN-CVE-2018-3740
A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element...