10638 matches found
CVE-2017-15964
Job Board Script Software allows SQL Injection via the PATHINFO to a /job-details URI...
CVE-2017-15959
CVE-2017-15959 affects Adult Script Pro 2.2.4 . The vulnerability is a SQL injection via the request path (PATH_INFO) to the /download URI, as described in multiple sources. The root cause is unsafely handling PATH_INFO leading to SQL command injection; the issue is reported as a separate vulnera...
CVE-2017-15959
Adult Script Pro 2.2.4 allows SQL Injection via the PATHINFO to a /download URI, a different vulnerability than CVE-2007-6576...
fastreader Gem for Ruby URI Handling Arbitrary Command Injection
fastreader Gem for Ruby contains a flaw that is triggered during the handling of specially crafted input passed via a URL that contains a ';' character. This may allow a context-dependent attacker to potentially execute arbitrary commands...
GHSA-R23G-3QW4-GFH2 RedCloth Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI...
RedCloth Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI...
GHSA-W248-XR37-JX8M fastreader Gem for Ruby URI Handling Arbitrary Command Injection
fastreader Gem for Ruby contains a flaw that is triggered during the handling of specially crafted input passed via a URL that contains a ';' character. This may allow a context-dependent attacker to potentially execute arbitrary commands...
rack-ssl Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack...
GHSA-333X-9VGQ-V2J4 Directory Traversal in geddy
Versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack via URI encoded attack vectors. Proof of Concept http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd Recommendation Update geddy to version = 13.0.8...
Moderate severity vulnerability that affects validator
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via a crafted javascript URI...
CVE-2017-15380
XSS exists in the E-Sic 1.0 /cadastro/index.php URI aka the requester's registration area via the nome parameter...
CVE-2017-15687
DOM Based Cross Site Scripting XSS exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI...
CVE-2017-15687
DOM Based Cross Site Scripting XSS exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI...
CVE-2017-15379
An authentication bypass exists in the E-Sic 1.0 /index aka login URI via '=''or' values for the username and password...
Authentication flaw
An authentication bypass exists in the E-Sic 1.0 /index aka login URI via '=''or' values for the username and password...
CVE-2017-15687
DOM Based Cross Site Scripting XSS exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI...
CVE-2017-15379
An authentication bypass exists in the E-Sic 1.0 /index aka login URI via '=''or' values for the username and password...
WePay: [stage-go.wepay.com] XSS via Request URI
PoC Open URL in Internet Explorer. This vulnerability only works in Internet Explorer and possibly in Edge, since it is necessary to send a Request-URI without a URL Encode, which is only possible in this browser via redirect...
Mac OS X 10.12 isolation mechanism bypass vulnerability
Vulnerability summary Mac OS X a vulnerability exists that could allow an attacker to bypass the Apple of the isolation mechanism, without any restrictions to execute arbitrary JavaScript code. Vulnerability submitter From WeAreSegment security researcher Filippo Cavallarin to Beyond Security SSD...