CVE-2017-0256

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests...

Cross-Site Scripting (XSS)

atlas-dashboardv2 is vulnerable to reflected cross-site scripting XSS attacks. The search function does not sanitize the search queries that are passed to the application, allowing a malicious user to inject and execute arbitrary javascript...

Updated squirrelmail packages fix security vulnerability

Squirrelmail version 1.4.22 and probably prior is vulnerable to a remote code execution vulnerability because it fails to sanitize a string before passing it to a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server CVE-2017-7692...

Cross-site Scripting (XSS)

sanitize-html is vulnerable to cross-site scripting XSS attacks. These attacks are possible through the use of double quotes...

Concrete CMS: Stored XSS in RSS Feeds Title (Concrete5 v8.1.0)

Summary / Description: The RSS Feeds Title pfTitle= parameter does not correctly sanitize user input. This allows HTML & Javascript to be stored and executed any time someone visits /index.php/dashboard/pages/feeds Steps to Reproduce 1. Open up Firefox 2. Login /index.php/login 3. Visit...

XiongMai uc-http 1.0.0 Local File Inclusion / Directory Traversal

uc-httpd is an HTTP daemon used by a wide array of IoT devices and is vulnerable to local file inclusion and directory traversal bugs. +---------------------------------------------------------+ | Vulnerable Software: uc-httpd | | Vendor: XiongMai Technologies | | Vulnerability Type: LFI, Directo...

CVE-2017-0165

An elevation of privilege vulnerability exists when Microsoft Windows running on Windows 10, Windows 10 1511, Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 fails to properly sanitize handles in memory, aka "Windows Elevation of Privilege Vulnerability."...

Cross-site Scripting (XSS)

sanitize-html is vulnerable to cross-site scripting XSS attacks. These attacks are possible through nonTextTags...

Cross-site Scripting (XSS)

airflow is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the markup before rendering, allowing a malicious user to inject and execute arbitrary javascript...

Cross-Site Scripting

Overview Affected versions of i18next may fail to sanitize user input when certain configuration options are used. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. Proof of Concept var init = i18n.ini...

CVE-2017-6306

An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "9 of 9. Directory Traversal using the filename; SanitizeFilename function in settings.c."...

DEBIAN-CVE-2017-6306

An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "9 of 9. Directory Traversal using the filename; SanitizeFilename function in settings.c."...

UBUNTU-CVE-2017-6306

An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "9 of 9. Directory Traversal using the filename; SanitizeFilename function in settings.c."...

U.S. Dept Of Defense: Content-Injection/XSS ████

Summary: Hi, It is possible to inject content and vulnerable to reflected Cross Site Scripting. Affected domain: https://██████████ Used browser: Mozilla. Impact One of the most common XSS attack vectors is to hijack legitimate user accounts by stealing their session cookies. This allows attacker...

Zimbra < 8.7.0 Multiple Vulnerabilities

Zimbra is prone to multiple security vulnerabilities because it fails to sanitize user-supplied input. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Persistent Cross-site Scripting (XSS)

ghost is vulnerable to persistent cross-site scripting XSS. This is because it fails to sanitize user data, thus making it possible for an attacker to supply crafted input in order to harm third party users...

Discourse: XSS in topics because of bandcamp preview engine vulnerability

Load http://try.discourse.org 2. Click "New topic" 3. Enter this payload https://89.223.28.48/bandcamp.com/album/index.html?XSSa2 to field with placeholder "Type title or paste a link here" 4. Wait for the preview engine to parse the link 4. XSS will fire F151439 You should sanitize external...

Splunk 6.1.1 - 'Referer' Header Cross-Site Scripting

Exploit Title: Splunk 'Referer' Header Cross Site Scripting Vulnerability Date: 7th January 2017 Exploit Author: justpentest Vendor Homepage: http://www.splunk.com/ Version: Splunk 6.1.1 other versions may also be affected. Contact: [email protected] Source:...

openSUSE Security Update : GNU Health and it's dependencies (openSUSE-2017-6)

This update provides version 3.0.5 of GNU Health including several fixes and improvements. - Update to ICD10 version 2016. - Fix error when printing prescription using review dates. - Fix error on summary report when no date of birth is assigned to the person. Additionally the following...

Code injection

include/functionsinstaller.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include call in the...