CVE-2018-16625: Improper Neutralization of Input During Web Page Generation

index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

CVE-2018-12299: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names...

The vulnerability of the SAP NetWeaver Java Application Server, a software integration platform of SAP NetWeaver, allows attackers to inject arbitrary code into the web pages that are uploaded.

The vulnerability of SAP NetWeaver Java Application Server, a software integration platform of SAP NetWeaver, exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the loaded web pages...

Malicious Package

Overview All versions of requuest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...

Malicious Package

Overview All versions of requesst typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...

Critical Unpatched Flaw Disclosed in WordPress WooCommerce Extension

If you own an eCommerce website built on WordPress and powered by WooCommerce plugin, then beware of a new, unpatched vulnerability that has been made public and could allow attackers to compromise your online store. A WordPress security company—called "Plugin Vulnerabilities "—that recently gone...

PHP Scripts Mall Image Sharing Script Directory Traversal Vulnerability

PHP Scripts Mall Image Sharing Script is an image sharing script that can also be used to share digital content such as music, videos, templates and more. A directory traversal vulnerability exists in PHP Scripts Mall Image Sharing Script 1.3.4. This vulnerability can be exploited to achieve...

Debian: Security Advisory (DLA-1707-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Bolt Arbitrary PHP Code Execution Vulnerability

Bolt is a simple CMS written in PHP. An arbitrary PHP code execution vulnerability exists in Controller/Async/FilesystemManager.php in filemanager in versions prior to Bolt 3.6.5. A remote attacker can execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension...

The vulnerability of the Email Collectors component in the Juniper ATP intrusion prevention system allows a intruder to inject any arbitrary JavaScript code into the uploaded page and gain access to protected data.

The vulnerability of the Email Collectors component in the Juniper ATP intrusion prevention system is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript code into the uploaded page and gain access to protected da...

The vulnerability of the Golden VM component in the Juniper ATP intrusion prevention system allows a intruder to inject arbitrary JavaScript code into the loaded page and gain access to protected data.

The vulnerability of the Golden VM component in the Juniper ATP intrusion prevention system is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript code into the uploaded page and gain access to protected data...

The vulnerability of the License Manager Service, a system for automating the management of technological processes at Yokogawa companies, allows a perpetrator to execute arbitrary code.

The vulnerability of the License Manager Service, a system for automating the management of technological processes at Yokogawa, is related to errors in the checking of uploaded files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted...

The vulnerability in the web interface of the Cisco Prime Infrastructure software management tool allows a hacker to inject arbitrary code into the uploaded web page.

The vulnerability in the web interface of the Cisco Prime Infrastructure network lifecycle management software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the loaded web pag...

Meta Box < 4.16.2 - Mishandled Uploaded Files

The Meta Box – WordPress Custom Fields Framework WordPress plugin was affected by a Mishandled Uploaded Files security vulnerability...

The vulnerability of the UpdateSite function in the software controller for centralized control of wireless networks by D-Link Central WiFi Manager allows a intruder to inject any arbitrary code into the uploaded web page.

The vulnerability of the UpdateSite function in the software controller for D-Link Central WiFi Manager exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the uploaded web page remotely...

The vulnerability of the software controller for the centralized control of wireless networks by D-Link Central WiFi Manager arises from the lack of measures taken to protect the website structure. This allows a hacker to inject arbitrary code into the uploaded web page.

The vulnerability of the addUser function in the software controller for D-Link Central WiFi Manager exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the uploaded web page remotely...

DEBIAN-CVE-2018-19789

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint string in a setter method e.g. setNamestring $name of a class that's the dataclass of a form, and when a...

UBUNTU-CVE-2018-19789

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint string in a setter method e.g. setNamestring $name of a class that's the dataclass of a form, and when a...

CVE-2018-19789

CVE-2018-19789 affects Symfony core forms: when using a scalar type hint (string) in a form data_class setter (e.g., setName(string $name)) and a file is uploaded instead of text input, UploadedFile::__toString() returns the file path, potentially leading to information disclosure. Some combinati...

The vulnerability in the web interface of the microprogramming software for Cisco Wireless LAN Controllers of the 5500 series allows a hacker to inject arbitrary code into the uploaded web page.

The vulnerability of the web interface of microprogramming software for Cisco Wireless LAN Controllers of the 5500 series is related to insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the web page via a...