10680 matches found
Cross site scripting
Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting XSS or open redirect attacks...
CVE-2015-3257
Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting XSS or open redirect attacks...
SAP NetWeaver K.M. Web Page Composer URI Redirection Vulnerability
SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A URI redirection vulnerability exists in SAP NetWeaver K.M. Web Page Composer due to the application failing to...
Cross site scripting
Cross-site scripting XSS vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI...
CVE-2015-4699
Cross-site scripting XSS vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI...
CVE-2015-4699
Cross-site scripting XSS vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI...
chm.uri.edu XSS vulnerability
Vulnerable URL: https://www.chm.uri.edu/chemsite2013/index.php?email=%22%3E%3Csvg/onload=alert/XSSPOSED/%3E=facpage=Faculty%20and%20Research=index.php?dest=facres=facres Details: Description| Value ---|--- Patched:| No Latest check for patch:| 22.11.2017 Vulnerability type:| XSS Vulnerability...
Atlassian OAuth Server-Side Request Forgery Vulnerability
Atlassian OAuth Plugin is an authorization plugin from Atlassian Australia for accessing personal Atlassian software data. A security vulnerability exists in the IconUriServlet in the Atlassian OAuth Plugin. A remote attacker could exploit the vulnerability to access internal network resources or...
Hiking Club Malvertisements Drop Monero Miners Via Neptune Exploit Kit
Exploit kit EK activity has been on the decline ever since Angler Exploit Kit was shut down in 2016. Fewer people using Internet Explorer and a drop in browser support for Adobe Flash – two primary targets of many exploit kits – have also contributed to this decline. Additionally, some popular...
Hiking Club Malvertisements Drop Monero Miners Via Neptune Exploit Kit
Exploit kit EK activity has been on the decline ever since Angler Exploit Kit was shut down in 2016. Fewer people using Internet Explorer and a drop in browser support for Adobe Flash – two primary targets of many exploit kits – have also contributed to this decline. Additionally, some popular...
CVE-2015-3649
The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created...
Code injection
The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created...
CVE-2015-3649
The CVE-2015-3649 entry concerns the Ruby gem open-uri-cached. Affected component: open-uri-cached Ruby gem; root cause: insecure/predictable temporary file handling in /tmp, where a directory named with openuri- and a meta/marker file is created, allowing a local attacker to place Ruby code and ...
CVE-2015-3649
The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created...
Nextcloud: Stored XSS in OAuth redirect URI
An admin could inject a stored XSS in the OAuth redirect URI...
X (Formerly Twitter): [dev.twitter.com] XSS and Open Redirect
Description === XSS via Request-URI which requires user interaction. The vulnerability is caused by the difference in the Request-URI processing in the Location header and in the link on the page. By creating an incorrect port in the link on the Location header, you can block the redirection for...
Internet Bug Bounty: RCE via ssh:// URIs in multiple VCS
I'd like to submit an RCE issue within Git SVN and Mercurial, the CVEs are: CVE-2017-9800 Subversion CVE-2017-1000116 Mercurial hg CVE-2017-1000117 Git Further Info can be found at: http://blog.recurity-labs.com/2017-08-10/scm-vulns And product specific:...
CVE-2017-11149
Server-side request forgery SSRF vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI...
Server side request forgery (ssrf)
Server-side request forgery SSRF vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI...