4668 matches found
CVE-2018-19545
JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...
CVE-2018-19544
JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...
Cross site request forgery (csrf)
JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...
JEECMS Cross-Site Request Forgery Vulnerability
JEECMS is a set of China Jinlei Technology Development Corporation using Java language development of content management systems CMS. A cross-site request forgery vulnerability exists in JEECMS version 9.3. A remote attacker can use api/admin/role/save URI to add users...
JEECMS Cross-Site Request Forgery Vulnerability (CNVD-2018-26785)
JEECMS is a set of China Jinlei technology development company using Java language development of content management system CMS. A cross-site request forgery vulnerability exists in JEECMS version 9.3. A remote attacker can exploit this vulnerability to add news with the help of...
CVE-2018-19060
An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path...
FruityWifi Code Execution Vulnerability
FruityWifi is a wireless network auditing tool. A security vulnerability exists in the www/modules/save.php file in FruityWifi 2.4 and earlier versions. A remote attacker can exploit this vulnerability by sending a specially crafted 'modname' parameter via a POST request to execute arbitrary code...
Design/Logic Flaw
Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...
Cross-site Scripting Vulnerability in Tianti CMS (CNVD-2019-09099)
Ladder tianti is a free lightweight CMS system written in Java. A stored cross-site scripting vulnerability exists in the user list module in tianti 2.3, which can be exploited by an attacker via the tianti-module-admin/user/ajax/saverole name parameter to conduct a cross-site scripting attack...
UBUNTU-CVE-2018-19060
An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path...
UBUNTU-CVE-2018-12402
The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resource...
September 26, 2018—KB4458469 (OS Build 17134.320)
None None...
CVE-2018-17366
An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do...
CyberChef - The Cyber Swiss Army Knife [A Web App For Encryption, Encoding, Compression And Data Analysis]
The Cyber Swiss Army Knife CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. These operations include simple encoding like XOR or Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps, compression an...
Microweber Cross-Site Request Forgery Vulnerability
Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site request forgery vulnerability exists in Microweber version 1.0.7. A remote...
PT-2018-13565 · Yfcmf · Yfcmf
Name of the Vulnerable Software and Affected Versions: YFCMF version 3.0 Description: The issue allows for Cross-Site Request Forgery CSRF attacks, enabling an attacker to add an administrator account through the admin/admin/adminsave.html endpoint. Recommendations: For YFCMF version 3.0, conside...
CVE-2018-16373
Frog CMS 0.9.5 is affected by a file-upload vulnerability described as an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save. The available sources (NVD/NVD-derived entries and CNVD/PRION/CVE records) consistently identify Frog CMS 0.9.5 and the file_manager/save end...
CVE-2018-16366
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF...
