721 matches found
CVE-2018-19844
FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319...
CVE-2018-19844
FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319...
CVE-2018-19844
FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319...
PT-2018-15126
Name of the Vulnerable Software and Affected Versions FROG CMS version 0.9.5 Description The issue concerns a mishandling of the name parameter during an edit action in the admin/?/snippet/add API Endpoint. This leads to a potential XSS issue. Recommendations For FROG CMS version 0.9.5, avoid usi...
CVE-2018-19844: Improper Neutralization of Input During Web Page Generation
FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319...
Chaturbate: Unrestricted POST request size on roomlogin endpoint
POST requests to endpoint /roomlogin/ are not limited in size. While the main website login endpoint correctly limits the size of request, this endpoint does not. This can be a mean to perform a DOS attack. Steps To Reproduce: 1. has a password-protected stream. 2. Send a large POST request to...
Monstra CMS Arbitrary PHP Code Execution Vulnerability (CNVD-2019-03475)
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. An arbitrary PHP code execution vulnerability exists in Monstra CMS version 3.0.4, which stems from the...
Code injection
Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=editsnippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a ?php substring...
CVE-2018-15886
Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=editsnippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a ?php substring...
CVE-2018-15886
Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=editsnippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a ?php substring...
CVE-2018-15886
Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=editsnippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a ?php substring...
CVE-2018-15886: Improper Control of Generation of Code
Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=editsnippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a...
PT-2018-13270
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns the improper restriction of modified Snippet content. This is demonstrated through the "admin/index.php?id=snippets&action=edit snippet&filename=google-analytics" URI, which allows...
PT-2018-12755
Name of the Vulnerable Software and Affected Versions Wolf CMS version 0.8.3.1 Description The issue concerns a problem with the Snippets tab, where there is an XSS issue. This can be demonstrated by accessing the /admin/snippet/edit/1 API endpoint. Recommendations For Wolf CMS version 0.8.3.1,...
CVE-2018-14837: Improper Neutralization of Input During Web Page Generation
Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI...
Xapian xapian-core Cross-Site Scripting Vulnerability
Xapian xapian-core is a Xapian project using C++ language written in open source search engine library . A cross-site scripting vulnerability exists in the queryparser/termgeneratorinternal.cc file in Xapian xapian-core versions prior to 1.4.6, which stems from the 'Xapian::MSet::snippet' functio...
Cross-site Scripting (XSS)
Overview xapian-core is a provides Xapian libraries and Ruby bindings. Affected versions of this package are vulnerable to Cross-site Scripting XSS. A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escapi...
DEBIAN-CVE-2018-0499
A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet...