10766 matches found
CVE-2018-20371
PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.htmlpasswd1" and "GET /login.htmlpasswd2" and so on...
CVE-2018-20367
The "mall some commodity details: commodity consultation" component in WSTMart 2.0.8181212 has stored XSS via the consultContent parameter, as demonstrated by the index.php/home/goodsconsult/add.html URI...
The vulnerability of the Web Isolation software lies in its inability to protect the structure of web pages. This allows attackers to inject arbitrary code into the loaded web pages.
The vulnerability of the software for preventing web threats exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor, operating remotely, to inject arbitrary code into the loaded web page using a specially crafted URI...
Design/Logic Flaw
CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI...
CVE-2018-19507
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...
Design/Logic Flaw
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...
CVE-2018-19598
CVE-2018-19598 affects Statamic 2.10.3. A stored/reflected-like XSS exists via the First Name or Last Name fields in an ‘Add new user’ request to the /users URI. Public exploitation details are not provided in the provided documents. No remediation details are included here.
CVE-2018-19507
CMSimple 4.7.5 is affected by a stored/reflected XSS issue triggered by an admin request using the URI parameter ?file=config&action=array. The NVD entry indicates the vulnerability exists in the web application’s handling of user-supplied input, enabling HTML/script injection that can potentiall...
CVE-2018-19507
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...
CVE-2018-19506
Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI...
Cross site scripting
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...
CVE-2018-20137
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI...
CVE-2018-20136
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...
The vulnerability of Cisco Unified Communications Domain Manager relates to insufficient protection of the website structure, allowing attackers to inject arbitrary code into the uploaded web pages.
The vulnerability of the Cisco Unified Communications Domain Manager relates to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted URI address from a remote location...
CVE-2018-20064
CVE-2018-20064 concerns doorGets 7.0, where a directory-traversal flaw lets remote attackers write arbitrary files. The root cause is a crafted request to dg-user/?controller=theme&action=edit&name=doorgets&file=../../1.txt%00 with content provided in theme_content_nofi, enabling arbitrary file w...
Mail.ru: XSS
Reflected XSS via URI in allods.mail.ru. allods.mail.ru belongs to extended scope...
[SECURITY] Fedora 28 Update: uriparser-0.9.0-1.fc28
Uriparser is a strictly RFC 3986 compliant URI parsing library written in C. uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license...
Code injection
IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the httpServletRequestauthenticate API when an unprotected URI is accessed. IBM X-Force ID: 153629...