CVE-2017-1000383: Exposure of Sensitive Information to an Unauthorized Actor

GNU Emacs version 25.3.1 and other versions most likely ignores umask when creating a backup save file "ORIGINALFILENAME" resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary...

GHSA-4JM3-PFPF-H54P espeak-ruby allows arbitrary command execution

The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or byteswav method in lib/espeak/speech.rb...

UBUNTU-CVE-2017-14955

CheckMK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report...

CVE-2017-14955: Exposure of Sensitive Information to an Unauthorized Actor

CheckMK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report...

libexif Denial of Service Vulnerability

libexif is a library of functions written in C to read and write EXIF meta-information from graphics files. A security vulnerability in the 'exifdatasavedataentry' function in the libexif/exif-data.c file in libexif version 0.6.21 and earlier stems from the program failing to correctly calculate...

CVE-2017-11567

Cross-site request forgery CSRF vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to mgadmin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely...

CVE-2017-11567: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to mgadmin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely...

ncurses denial of service vulnerability (CNVD-2017-25655)

ncurses new curses is a library of programs that provides APIs that allow programmers to write text-based user interfaces that are independent of the terminal. A denial of service vulnerability exists in the ncsavestr function in allocentry.c in Ncurses, which can be exploited by a remote attacke...

zzcms8. 1 Background save ad add storage type xss

No description provided by source...

Disk Savvy Enterprise 9.9.14 - Buffer Overflow (SEH) Exploit

Exploit for windows platform in category remote exploits !/usr/bin/env python Exploit Title: Disk Savvy Enterprise 9.9.14 Remote SEH Buffer Overflow Date: 2017-08-25 Exploit Author: Nipun Jaswal & Anurag Srivastava Author Homepage: www.pyramidcyber.com Vendor Homepage: http://www.disksavvy.com...

save-wildlife.org XSS vulnerability

Vulnerable URL: https://www.save-wildlife.org/de/kontakt Details: Description| Value ---|--- Patched:| Yes, at 26.11.2017 Latest check for patch:| 26.11.2017 15:08 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2463037 VIP website status:| No Check...

WebsiteBaker Arbitrary PHP Code Execution Vulnerability

WebsiteBaker is an open source PHP content management system CMS maintained and developed by the WebsiteBaker organization. The system supports WYSIWYG editor, search engine optimization and add-ons. A security vulnerability exists in the install\save.php file in WebsiteBaker version 2.10.0. The...

CVE-2017-9771

install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the databaseusername, databasehost, or databasepassword parameter...

Fastspot BigTree 'admin.php' File Denial of Service Vulnerability

Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A security vulnerability exists in the admin.php file in Fastspot BigTree 4.2.18 and earlier versions. A remote attacker can exploit this vulnerability to cause a denial of...

123ContactForm - Cross Site Scripting Web Vulnerability

Document Title: =============== 123ContactForm - Cross Site Scripting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1982 Ref: 123-1476631846 Release Date: ============= 2017-06-12 Vulnerability Laboratory ID VL-ID:...

CVE-2017-9448: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\save-revision.php and core\admin\modules\pages\revisions.php. Low-privileged...

CVE-2017-9337

The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post...

Cross site scripting

The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post...

asc-connections.com XSS vulnerability

Vulnerable URL: https://asc-connections.com/register-with-save-search?keywords="'--!confirmOPENBUGBOUNTY//...

CVE-2017-9337: Improper Neutralization of Input During Web Page Generation

The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post...