The vulnerability of the FortiOS operating system arises from insufficient protection of the web page structure, allowing attackers to inject arbitrary JavaScript or HTML code.

The vulnerability of the FortiOS operating system is due to insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript or HTML code using a specially crafted URI...

The vulnerability of the Microsoft SharePoint Server software lies in the insufficient protection of website structures, which allows attackers to execute cross-site scripting attacks with elevated privileges.

The vulnerability of the Microsoft SharePoint Server software is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks with elevated privileges using specially crafted requests...

The vulnerability of the Microsoft SharePoint Server software lies in the insufficient protection of website structures, which allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Microsoft SharePoint Server software is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks with elevated privileges...

The vulnerability of the Microsoft SharePoint Server software lies in the insufficient protection of website structures, which allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Microsoft SharePoint Server software is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Foxit PhantomPDF HTML2PDF HTML Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion ...

Adobe Acrobat ImageConversion EMF EmfPlusDrawBeziers Out-Of-Bounds Read Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsin...

Microsoft Internet Explorer CSS Style Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Acrobat Pro DC ImageConversion EMF EMR_COMMENT Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17835

An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI...

Epee Levin Packet Deserialization Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the Levin deserialization functionality of the epee library. A specially crafted network packet can cause a logic flaw, resulting in code execution. An attacker can send a packet to trigger this vulnerability. Tested Versions Monero...

Lucy Gang Debuts with Unusual Android MaaS Package

There’s a fresh bloom in the malware-as-a-service garden: Researchers have uncovered a new Russian-speaking threat actor hawking a proprietary cyber-weapon dubbed “Black Rose Lucy.” The offering is a malware-as-a-service MaaS bundle with two parts, consisting of a controlling web interface which...

CVE-2017-18302

In Snapdragon Automobile ,Mobile in version MSM8996AU, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SnapdragonHighMed2016, a crafted HLOS client can modify the structure in memory passed to a QSEE...

The vulnerability of the CA Release Automation system arises from the restoration of an unreliable data structure in memory, allowing a perpetrator to execute arbitrary code.

The vulnerability of the CA Release Automation system arises from the restoration of a dubious data structure in memory. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code using a specially crafted serialized object...

Open .Git Directories Leave 390K Websites Vulnerable

A scan of more than 230 million web domains worldwide has uncovered 390,000 web pages with open .git directories – a worrying state of affairs that can expose a range of sensitive information. Researcher Vladimír Smitka at Lynt Services performed the scan, starting first in his native Czech...

ExchangeRelayX - An NTLM Relay Tool To The EWS Endpoint For On-Premise Exchange Servers (Provides An OWA For Hackers)

Version 1.0.0. This tool is a PoC to demonstrate the ability of an attacker to perform an SMB or HTTP based NTLM relay attack to the EWS endpoint on an on-premise Microsoft Exchange server to compromise the mailbox of the victim. This tool provides the attacker with an OWA looking interface, with...

Vulnerability of Microsoft COM components in Windows operating systems, allowing attackers to execute arbitrary code

The vulnerability of the Microsoft Component Object Model COM in Windows operating systems is related to the restoration of a dubious data structure in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file or script...

Sql injection

PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service resource consumption via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564...

CVE-2018-16303

PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service resource consumption via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564...

CVE-2018-16303

PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service resource consumption via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564...

UBUNTU-CVE-2018-16058

In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth AVDTP dissector could crash. This was addressed in epan/dissectors/packet-btavdtp.c by properly initializing a data structure...