UBUNTU-CVE-2018-20677

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property...

CVE-2016-10735

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041...

CVE-2018-20677

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property...

Rockwell Automation Allen Bradley Micrologix 1400 Series Device Power Cycle Denial of Service (CVE-2017-12088; CVE-2017-12089; CVE-2017-12090; CVE-2017-12092; CVE-2017-12093)

A denial of service vulnerability exists in Rockwell Automation Allen Bradley Micrologix 1400 Series. A remote, unauthenticated attacker can exploit the vulnerability by sending crafted packets to the target system...

Microsoft Word Information Disclosure Vulnerability

Microsoft Office is an office software suite of products developed by the United States Microsoft Microsoft.Word is a word processing software in the Office suite. An information disclosure vulnerability exists in Microsoft Word, which can be exploited by an attacker to read arbitrary files from...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

In Bootstrap, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041...

PT-2019-7534 · Twitter +4 · Bootstrap +4

Name of the Vulnerable Software and Affected Versions: Bootstrap versions 2.0.4 through 3.x before 3.4.0 Bootstrap versions 4.x-beta before 4.0.0-beta.2 Description: XSS is possible in the data-target attribute. This issue is different from other known vulnerabilities. Recommendations: For...

Updated plexus-archiver packages fix security vulnerability

A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names. A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with malicious code or...

SugarCRM (Web Logic Hooks module) Path Traversal Vulnerability

SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A path traversal...

Fedora 29 : systemd (2018-c402eea18b)

Fix a local vulnerability from a race condition in chown-recursive CVE-2018-15687, 1639076 - Fix a local vulnerability from invalid handling of long lines in state deserialization CVE-2018-15686, 1639071 - Fix a remote vulnerability in DHCPv6 in systemd-networkd CVE-2018-15688, 1639067 - The DHCP...

gdal/gdal_translate_fuzzer: Heap-buffer-overflow in VSIMemHandle::Read

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5757307697233920 Project: gdal Fuzzer: libFuzzergdaltranslatefuzzer Fuzz target binary: gdaltranslatefuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

PVS target devices are randomly getting unregistered and going down in PVS console

Target devices show up and running in hypervisor console Targets show down in PVS console and get unregistered intermittently Restart fixes the issue During the time of issue, ping to the target device works,but RDP fails...

Rockwell Automation Allen Bradley Micrologix 1400 Series Access Control Information Disclosure (CVE-2017-14462)

An Information Disclosure vulnerability exists in Rockwell Automation Allen Bradley Micrologix 1400 Series. A remote, unauthenticated attacker can exploit the vulnerability by sending crafted packets to the target system causing access control and information disclosure...

Formjacking Campaign Suspicious JavaScript

Some Web sites include heavily-obfuscated JavaScript code with hidden redirection. Hidden redirection can cause unintended browser behavior which can lead to downloading malicious files. Successful exploitation could allow attackers to execute arbitrary code on the target...

Apple WebKit Memory Corruption (CVE-2018-4233)

A remote code execution vulnerability exists in Apple WebKit. The vulnerability is due to a memory corruption when handling of objects in javascript JIT. A remote attacker could exploit the vulnerability by enticing the target user to open a specially crafted js webpage. Successful exploitation...

WebFairy Mediat 1.4.1 Cross Site Scripting

Exploit Title: Mediat 1.4.1 - Cross-site Script Google Dork: N/A Date: 1 Jan 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me Vendor Homepage: http://webfairy.net/ Software Link: https://github.com/WebFairyNet/Mediat Demo Website:...

Kubernetes - (Unauthenticated) Arbitrary Requests Exploit

!/usr/bin/env python3 import argparse from ssl import wrapsocket from json import loads, dumps from socket import createconnection def requeststage1base, version, target: stage1 = "" with open'ustage1', 'r' as stage1fd: stage1 = stage1fd.read return stage1.formatbase, version, target .encode'utf-...

GPON ONT Home Gateway Router is vulnerable to authenticated remote command execution (CVE-2018-10562)

Binary data gponcve-2018-10562.nbin...

GPON ONT Home Gateway Router is vulnerable to authentication bypass (CVE-2018-10561)

Binary data gponcve-2018-10561.nbin...

CVE-2018-19790

An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the failurepath input field of login forms, an attacker can work around the redirection target restrictio...