10771 matches found
CVE-2018-10498
CVE-2018-10498 affects Samsung Email and stems from improper validation in the handling of file:/// URIs, enabling local attackers with low-privilege code execution to read arbitrary files and disclose sensitive information. The issue requires local access and is documented with the ZDI advisory ...
CVE-2018-16833
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI...
Design/Logic Flaw
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI...
CVE-2018-16833
CVE-2018-16833 affects Zoho ManageEngine Desktop Central 10.0.271. The vulnerability is a reflected cross‑site scripting (XSS) flaw triggered by input in the "Features & Articles" search field that targets the /advsearch.do?SUBREQUEST=XMLHTTP URI. Connected sources corroborate the impact as arbit...
CVE-2018-16833
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI...
CVE-2018-15832
CVE-2018-15832 affects Ubisoft Uplay Desktop Client (upc.exe) version 63.0.5699.0, where the vulnerability arises from improper validation of a user-supplied string used in a system call during URI handling. This allows remote code execution under the current process context. Exploitation require...
ManageEngine Desktop Central 10.0.271 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: ManageEngine Desktop Central 10 - Cross-Site Scripting Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/desktop-central/ Software : ZOHO Corp...
CVE-2018-12243
The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity XXE exploit, which is a type of issue where XML input containing a reference to an external entity is processed by a weakly configured XML parser. The attack uses file URI schemes or relative paths ...
Xxe
The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity XXE exploit, which is a type of issue where XML input containing a reference to an external entity is processed by a weakly configured XML parser. The attack uses file URI schemes or relative paths ...
Mail.ru: Чтение файлов на сервере и раскрытие директорий mediator.media
It was possible to access some internal addresses and special URI schemes due to lack of URI filteint on page submission. mediator.media it not in the Bug Bounty scope, the bounty was issued due to problem severity...
Ubisoft Uplay Desktop Client 63.0.5699.0 Remote Code Execution
Exploit Title: Ubisoft Uplay Desktop Client 63.0.5699.0 - Remote Code Execution Date: 2018-09-01 Exploit Author: Che-Chun Kuo Vulnerability Type: URI Parsing Command Injection Vendor Homepage: https://www.ubisoft.com/en-us/ Software Link: https://uplay.ubi.com/ Version: 63.0.5699.0 Tested on:...
Ubisoft Uplay Desktop Client 63.0.5699.0 - Remote Code Execution
Exploit Title: Ubisoft Uplay Desktop Client 63.0.5699.0 - Remote Code Execution Date: 2018-09-01 Exploit Author: Che-Chun Kuo Vulnerability Type: URI Parsing Command Injection Vendor Homepage: https://www.ubisoft.com/en-us/ Software Link: https://uplay.ubi.com/ Version: 63.0.5699.0 Tested on:...
LG SuperSign CMS File Upload Vulnerability
LG SuperSign CMS is a content management system for LG webOS from the Luckin LG Group in Korea. The system supports connection to external databases and allows access to the server from mobile devices. A file upload vulnerability exists in LG SuperSign CMS, which can be exploited by an attacker...
Ubisoft Uplay Desktop Client 63.0.5699.0 - Remote Code Execution Exploit
Exploit Title: Ubisoft Uplay Desktop Client 63.0.5699.0 - Remote Code Execution Exploit Author: Che-Chun Kuo Vulnerability Type: URI Parsing Command Injection Vendor Homepage: https://www.ubisoft.com/en-us/ Software Link: https://uplay.ubi.com/ Version: 63.0.5699.0 Tested on: Windows, Microsoft...
Ubisoft Uplay Desktop Client 63.0.5699.0 - Remote Code Execution
Ubisoft Uplay Desktop Client 63.0.5699.0 - Remote Code Execution Exploit Title: Ubisoft Uplay Desktop Client 63.0.5699.0 - Remote Code Execution Date: 2018-09-01 Exploit Author: Che-Chun Kuo Vulnerability Type: URI Parsing Command Injection Vendor Homepage: https://www.ubisoft.com/en-us/ Software...
CVE-2018-17139
UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type...
CVE-2018-17102
CVE-2018-17102 affects QuickAppsCMS (QACMS) up to version 2.0.0-beta2. The issue is a Cross-Site Request Forgery (CSRF) vulnerability that can change the administrator password via the /user/me URI. Documented impact indicates high-severity outcomes (e.g., unauthorized password change) with netwo...
CVE-2018-16288
LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs...
CVE-2018-16287
LG SuperSign CMS is affected by a file-upload vulnerability exploitable via signEzUI/playlist/edit/upload/..%2f URIs. The NVD entry CVE-2018-16287 documents a high-severity issue (CVSS v3.0: 9.8, Network attack, no authentication, no user interaction) leading to partial confidentiality, integrity...