Regular Expression Denial Of Service in uri-js

Affected versions of uri-js is susceptible to a regular expression denial of service vulnerability when user input is sent to the .parse method. Recommendation Update to v3.0.0 or later...

Vanilla: [allhiphop.vanillacommunities.com] XSS Request-URI

Summary: Reflected XSS via Request-URI for Internet Explorer. Steps to reproduce: 1. Open URL in Internet Explorer tested on IE 11 https://blackfan.ru/x?r=https://allhiphop.vanillacommunities.com/xxx%22-alertdocument.domain-%22xxx/%252e%252e/ blackfan.ru/x - a simple redirection script that is...

feedparser Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in feedparser.py in Universal Feed Parser aka feedparser or python-feedparser 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI...

Cross site scripting

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server"...

CVE-2018-14418

In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI...

Sql injection

In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI...

CVE-2018-14418

Summary: CVE-2018-14418 affects Msvod Cms v10 and is a SQL Injection vulnerability exploitable via the images/lists?cid= URI. The root cause is unsanitized input in the cid parameter, enabling arbitrary SQL commands. Public exploit content shows how payloads can retrieve database, user, and versi...

CVE-2018-14418

In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI...

Design/Logic Flaw

libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...

CVE-2018-14399

libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...

PT-2018-12490 · Phpcms · Phpcms

Name of the Vulnerable Software and Affected Versions: PHPCMS version 9.6.0 Description: The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved by sending a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the...

Regular Expression Denial Of Service (ReDoS)

validator is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a long URI to the isDataURI function to cause a ReDoS attack...

WolfSight CMS SQL Injection Vulnerability

WolfSight CMS is a content management system. The system features news management, e-commerce management, payment management and document editing. A SQL injection vulnerability exists in WolfSight CMS version 3.2. A remote attacker can exploit this vulnerability by sending PATHINFO to the default...

Sql injection

WolfSight CMS 3.2 allows SQL injection via the PATHINFO to the default URI...

CVE-2018-14012

WolfSight CMS 3.2 allows SQL injection via the PATHINFO to the default URI...

CVE-2018-14012

CVE-2018-14012 concerns WolfSight CMS 3.2, which is vulnerable to an SQL injection via PATH_INFO sent to the default URI. The connected records confirm the affected product/version and the injection vector, without listing explicit root-cause code or patched versions. CVSS scores indicate a very ...

A WordPress SPAMbot Wants You to Bet on the 2018 FIFA World Cup

Our researchers recently picked up on a spike in SPAM activity directed at sites powered by WordPress, which, naturally, led them to take a closer look. Turns out the attack was launched by a botnet and implemented in the form of comment SPAM - meaningless, generic text generated from a template...

Insufficient Input Validation in Bleach module in Intel® Distribution for Python (IDP) version IDP 2018 Update 2 potentially allows an unprivileged user to bypass URI sanitization and cause a Denial of Service via local vector

Summary: Insufficient Input Validation in Bleach module in Intel® Distribution for Python IDP version IDP 2018 Update 2 potentially allows an unprivileged user to bypass URI sanitization and cause a Denial of Service via local vector. Description: A vulnerable version of the Mozilla Bleach librar...

Directory traversal

Directory traversal vulnerability in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and ...

Cross site scripting

An issue was discovered in BEdita before 3.7.0. A cross-site scripting XSS attack occurs via a crafted pages/showObjects URI, as demonstrated by appending a payload to a pages/showObjects/2/0/0/leafs URI...