596 matches found
Information disclosure
An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted authentication request to an affected server, aka 'Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability'...
Cross-site Scripting (XSS)
vuex-router-sync is vulnerable to cross-site scripting XSS attacks. The route parameter used in the server-rendered store in Nuxt render:routeContext hook are not sanitized, allowing an attacker to insert arbitrary Javascript...
CVE-2018-20807
An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure PCS 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly...
Malwarebytes Anti-Malware URI Handler Remote Command Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Anti-Malware. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. There is an issue with the way the product handles URIs...
Path Traversal
total.js is vulnerable to path traversal attacks. The vulnerability exists in index.js where req.url is insufficiently sanitized, allowing path traversal attacks...
Vanilla: Stored XSS in vanilla
Summary: There is a stored XSS in the latest version 2.8 of vanilla. Attack with post privileges can trigger this. Description: In last report 481360, I found a XSS cause by Format. But in lastest version 2.8, the default Format of Discussion and Comment is Rich. In this Format, we can insert a...
rubygem-loofah: XSS vulnerability due to unescaped comments within attributes by libxml2
In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment...
Cross-site Scripting (XSS)
croogo/croogo is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the value of body of a Node is not sanitized, allowing XSS attacks...
CVE-2019-1646 Privilege Escalation Vulnerability in Cisco SD-WAN Solution
A vulnerability in the local CLI of the Cisco SD-WAN Solution could allow an authenticated, local attacker to escalate privileges and modify device configuration files. The vulnerability exists because user input is not properly sanitized for certain commands at the CLI. An attacker could exploit...
CVE-2018-6084
Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file...
Code injection
Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file...
CVE-2018-6084
Removed by vendor...
MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting
MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Date: 12/31/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on...
SugarCRM WorkFlow PHP Code Injection Vulnerability
SugarCRM versions prior to 7.9.4.0 and 7.11.0.0 suffer from a PHP code injection vulnerability in the WorkFlow module. User input passed through the $POST'basemodule' parameter to the "Save" action of the WorkFlow module is not properly sanitized before being used to write data into the...
DEBIAN-CVE-2018-16468
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished...
UBUNTU-CVE-2018-16468
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished...
CVE-2018-16468
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished...
CVE-2018-16468
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished...
Loofah -- XSS vulnerability
GitHub issue: This issue has been created for public disclosure of an XSS vulnerability that was responsibly reported independently by Shubham Pathak and @yasinS Yasin Soliman. In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is...
