5882 matches found
File (Field) Paths - Critical - Remote Code Execution - SA-CONTRIB-2018-056
This module enables you to automatically sort and rename your uploaded files using token based replacement patterns to maintain a nice clean filesystem. The module doesn't sufficiently sanitize the path while a new file is uploading, allowing a remote attacker to execute arbitrary PHP code. This...
UBUNTU-CVE-2016-8628
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as...
Design/Logic Flaw
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as...
Imgur: HTML Injection with XSS possible
Hi, I found HTML Injection on imgur.com Description: I couldn't get xss but i was able to include videos on my profile and also i was able to redirect users to malicious websites POC HTML injection: go to https://12test.imgur.com you don't need to login and you will see external videos and you wi...
ShopNx - Arbitrary File Upload Vulnerability
Exploit for php platform in category web applications Exploit Title: ShopNx - Angular5 Single Page Shopping Cart Application 1 - Arbitrary File Upload Exploit Author: L0RD Email: email protected Vendor Homepage: http://codenx.com/ Version: 1 CVE: CVE-2018-12519 Tested on: Win 10...
ShopNx - Arbitrary File Upload
Exploit Title: ShopNx - Angular5 Single Page Shopping Cart Application 1 - Arbitrary File Upload Date: 2018-07-03 Exploit Author: L0RD Email: [email protected] Vendor Homepage: http://codenx.com/ Version: 1 CVE: CVE-2018-12519 Tested on: Win 10...
CVE-2018-10860
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary...
Cross-site Scripting (XSS)
Microsoft.AspNet.SignalR is vulnerable to cross-site scripting XSS attack. The application does not properly sanitize user-supplied input before displaying it. This can allow a malicious user to inject and execute arbitrary code in the target user's browser which can lead to access to...
Gitlab -- multiple vulnerabilities
Gitlab reports: Wiki XSS Sanitize gem updates XSS in urlforparams Content injection via username Activity feed publicly displaying internal project names Persistent XSS in charts...
Sanitize-html cross-site scripting vulnerability (CNVD-2018-14553)
Sanitize-html is a tool for cleaning up user-submitted HTML. A cross-site scripting vulnerability exists in Sanitize-html 1.2.2 and earlier versions. A remote attacker can inject arbitrary web script or HTML by exploiting this vulnerability...
Sanitize-html Cross-Site Scripting Vulnerability
Sanitize-html is a tool for cleaning up user-submitted HTML. A cross-site scripting vulnerability exists in Sanitize-html 1.11.1 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via nonTextTags...
CVE-2018-8254
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft Project Server, Microsoft SharePoint...
CVE-2017-16017
sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability...
CVE-2017-16017
sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability...
CVE-2017-16016
Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting XSS in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability...
CVE-2017-16016
Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting XSS in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability...
Cross site scripting
Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting XSS in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability...
Cross site scripting
sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability...
CVE-2017-16017
The CVE-2017-16017 entry concerns the sanitize-html library where versions 1.2.2 and earlier are vulnerable to cross-site scripting (XSS). The root cause is inadequate sanitization allowing attacker-controlled HTML/input to induce XSS, as documented in multiple sources (e.g., OSV GHSA entry and n...
