6129 matches found
Portainer Access Restriction Bypass and Server-Side Request Forgery Vulnerabilities
Portainer is a lightweight user management interface for managing Docker environments and Docker hosts. A security vulnerability exists in Portainer versions prior to 1.18.0 that stems from the program's support for requests with unvalidated id query parameters. A remote attacker could use this...
connect cross-site scripting vulnerability
connect is an extended HTTP server framework for use in Node.js. A cross-site scripting vulnerability exists in versions of connect prior to 2.14.0, which stems from the program's lack of validation of files in the directory js middleware. This vulnerability can be exploited to inject arbitrary w...
SAP Hana DB, UI5 and UI Cross-Site Scripting Vulnerabilities
SAP Hana DB, UI5, and UI are products of SAP, an in-memory database based on rows and columns.UI5 and UI are JavaScript-based UI libraries that integrate a large number of UI controls. A security vulnerability exists in SAP Hana DB, UI5, and UI that stems from the program's failure to validate us...
CVE-2017-16652
An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the targetpath parameter and generates a redirect response, but no check is...
crud-file-server node module cross-site scripting vulnerability
The crud-file-server node module is a file server that supports create, read, update and delete functions. A cross-site scripting vulnerability exists in crud-file-server node module versions prior to 0.8.0, which stems from the program's lack of file name validation. A remote attacker can exploi...
Bob Hepple gjots2 Parameter Injection Vulnerability
Bob Hepple gjots2 is a suite of open source desktop notebook applications. A security vulnerability exists in the lib/gui.py file in Bob Hepple gjots2 version 2.4.1, which stems from the program failing to validate strings before starting the program. A remote attacker can exploit this...
Tkabber Parameter Injection Vulnerability
Tkabber is an instant messaging protocol GUI client based on XMPP. A security vulnerability exists in the default.tcl file in Tkabber version 1.1, which originates from the program failing to validate strings before starting the program. A remote attacker can exploit this vulnerability to perform...
Liberapay: Improper Data Validation / Unvalidated Input
Steps to reproduce: 1 - Be logged in a account 2 - Go to: https://liberapay.com/user/edit/statement 3 - Click on Visualize 4 - Submit and edit POST parameters to fuzz infinitely 5 - Wait the server proccess the request. I send only 2.813.054 characters. Improper input size validation... I'm sorry...
OCaml Batteries Included Parameter Injection Vulnerability
OCaml Batteries Included a.k.a. ocaml-batteries is a set of development platforms based on the OCaml language maintained by the OCaml community. A security vulnerability exists in the batteriesConfig.mlp file in OCaml Batteries Included version 2.6, which stems from the program failing to validat...
CVE-2018-3731
public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path...
CVE-2018-3729
localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path...
CVE-2018-3727
626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path...
PT-2018-16151 · 626 · 626
Name of the Vulnerable Software and Affected Versions: 626 versions all Description: The issue is related to a Path Traversal vulnerability due to the lack of validation of files, which allows a malicious user to read the content of any file with a known path. This enables a remote attacker to re...
PT-2018-16153 · Unknown · Localhost-Now
Name of the Vulnerable Software and Affected Versions: localhost-now versions prior to 1.0.2 Description: The issue arises from a lack of validation of file paths, allowing a malicious user to read the content of any file with a known path. This can be exploited by a remote attacker to read...
PT-2018-16140 · Unknown · Simplehttpserver
Name of the Vulnerable Software and Affected Versions: Simplehttpserver versions prior to 0.1.0 Description: The issue arises from a lack of validation of file names, leading to a Cross-Site Scripting vulnerability. An attacker can exploit this by controlling the filename of a file used in the...
PT-2018-16137 · Node.Js · Angular-Http-Server
Name of the Vulnerable Software and Affected Versions: angular-http-server versions prior to 1.6.0 Description: The angular-http-server node module has a Path Traversal issue due to the lack of validation of the possibleFilename variable, allowing a malicious user to read the content of any file...
wpForo Forum Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. wpForo Forum plugin is used in one of the forum plugin . WordPress wpForo Forum plugin version 1.4.12 before the...
CVE-2018-11479
The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe system process that establishes a \.\pipe\WindscribeService named pipe endpoint that allows the Windscribe VPN process to connect and execute an OpenVPN process or other processe...
Foxit Reader and PhantomPDF Remote Code Execution Vulnerability (CNVD-2018-11903)
Foxit Reader is a PDF document reader from China's Foxit Software Corporation.Foxit PhantomPDF is a commercial version. A remote code execution vulnerability exists in Foxit Reader versions prior to 9.1 and PhantomPDF versions prior to 9.1, which results from the program failing to properly...
