CVE-2018-10319

Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippetname parameter, aka Edit Snippet...

CVE-2018-10319

Frog CMS 0.9.5 is affected by a Cross‑Site Scripting (XSS) vulnerability in the admin/?/snippet/edit (snippet[name]) parameter, i.e., the Edit Snippet action. The issue enables injection via the snippet name during edit, as documented under CVE-2018-10319. Connected records also reference the rel...

Frog CMS Cross-Site Scripting Vulnerability (CNVD-2018-08555)

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A cross-site scripting vulnerability exists in Frog CMS version 0.9.5. A remote attacker can exploit the...

PT-2018-9824

Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue is related to a Cross-Site Scripting XSS problem. It occurs via the snippetname parameter in the /admin/?/snippet/edit API endpoint. Recommendations: For Frog CMS version 0.9.5, avoid using the...

CVE-2018-10319: Improper Neutralization of Input During Web Page Generation

Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippetname parameter, aka Edit Snippet...

Chrome V8 JIT Optmization Bug Exploit

Chrome V8 JIT suffers from a simplified-lowererer IrOpcode::kStoreField, IrOpcode::kStoreElement optimization bug. Chrome: V8: JIT: Simplified-lowererer IrOpcode::kStoreField, IrOpcode::kStoreElement optimization bug I think this commit has introduced the bugs:...

Fedora 26 : krb5 (2018-f97cb1c9b0)

Fix CVE-2018-5729, CVE-2018-5730. These are low-impact, requiring administrator access to exploit. ---- Fix leak in previous version. ---- Always read config snippets in alphabetical order per-directory. Note that Tenable Network Security has extracted the preceding description block directly fro...

Cross site scripting

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...

CVE-2017-18092

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...

CVE-2017-18092

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...

CVE-2017-18095

The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 the fixed version 4.5.x and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability...

CVE-2017-18092: Improper Neutralization of Input During Web Page Generation

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...

PT-2018-6671

Name of the Vulnerable Software and Affected Versions: Atlassian Crucible versions prior to 4.4.3 Atlassian Crucible versions prior to 4.5.0 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a...

Keybase: Claiming ownership of GitHub handles via forked GitHub gists.

Description An attacker can claim ownership of a GitHub user's handle if the user forks the attacker's gist with a verification snippet generated by the attacker pointing towards the user's handle. PoC With my colleague's permission @jackds I claimed their GitHub handle with this gist:...

CVE-2017-8802

Cross-site scripting XSS vulnerability in Zimbra Collaboration Suite aka ZCS before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality...

CVE-2017-8802

Cross-site scripting XSS vulnerability in Zimbra Collaboration Suite aka ZCS before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality...

Cross site scripting

Cross-site scripting XSS vulnerability in Zimbra Collaboration Suite aka ZCS before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality...

PT-2018-8453

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 8.8.0 Beta2 Description A cross-site scripting issue exists, potentially allowing remote attackers to inject arbitrary web script or HTML. This is related to the "Show Snippet" functionality...

CVE-2017-8802: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Zimbra Collaboration Suite aka ZCS before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality...

Razer US: Authenticated DOM-based XSS in deals.razerzone.com via the rurl parameter.

The researcher discovered that deals.razerzone.com was vulnerable to Authenticated DOM-based XSS via the rurl parameter, which could allow account hijacking via session cookies. The researcher identified the specific code snippet and provided two PoCs with different techniques. Another great repo...