SQL Injection

dolibarr/dolibarr is vulnerable to SQL injection attack. The attack is possible because it does not use prepared SQL queries in order to avoid injection of arbitrary code via user input SQL commands...

CVE-2018-1067

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input ...

SQL Injection

Overview All versions of query-mysql are vulnerable to SQL injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from database. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use thi...

Command Injection

Overview All versions of fs-path are vulnerable to command injection is unsanitized user input is passed in. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available. References - HackerOne Report -...

Signal Desktop HTML Tag Injection Variant 2

Title: Signal-desktop HTML tag injection variant 2 Date Published: 2018-05-16 Last Update: 2018-05-16 CVE Name: CVE-2018-11101 Class: Code injection Remotely Exploitable: Yes Locally Exploitable: No Vendors contacted: Signal.org Vulnerability Description: Signal-desktop is the standalone desktop...

Command Injection

open is vulnerable to command injection attacks. The library does not properly sanitize user input before concatenating it to the exec function, allowing a malicious user to inject and execute arbitrary commands...

SQL Injection

query-mysql is vulnerable to sql injections. The library does not properly sanitize user input, allowing a malicious user to inject and execute arbitrary SQL queries...

Remote Code Execution (RCE)

fs-path is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the lack of sanitization of user input when performing various operations such as copy, allowing malicious input to be executed...

Remote Code Execution (RCE)

command-exists is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the lack of sanitization of the user input used in the concatenation of commands to be executed, causing the RCE attack...

Microsoft SharePoint Server CVE-2018-8155 Remote Privilege Escalation Vulnerability

Description Microsoft SharePoint Server is prone to a remote privilege-escalation vulnerability because it fails to properly sanitize user-supplied input. An attacker may exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Technologies Affected Microsof...

Peel Shopping Cart 9.0.0 Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

Exploit for php platform in category web applications ================================================= Synopsis: Post XSS with dual CSRF via inproper sanitized user input. Product: Peel Shopping Cart Version: 9.0.0 Researcher: Matt Landers email protected twitter.com/matthewjland...

GitLab: XSS (Persistent) - Selecting role(s) for protected branches

Summary: When using the dropdown that selects the groups or users that are allowed to push or merge to a protected branch within a project, it is possible to trigger a XSS with a malicious user name string. Description: This vulnerability is similar to the recently announced CVE-2018-10379. The...

Google Golang Get Command Injection (CVE-2018-7187)

A command injection vulnerability exists in the golang client. This vulnerability is due to insufficient sanitization of user input by the go get command...

Cross-site Scripting (XSS)

rainlab/user-plugin is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the improper use of formvalue which does not provide escaping of user input, allowing XSS to occur...

Command Injection

Overview Versions of whereis before 0.4.1 are vulnerable to command injection if untrusted user input is passed into whereis. Recommendation Update to version 0.4.1 or later. References - HackerOne Report - GitHub Commit 0f64e37 - GitHub Advisory...

Memory Exposure

Overview Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure. This is exploitable if user supplied input is provided to the auth value and is a number. Proof-of-concept: js require'request' method: 'GET', uri: 'http://www.example.com', tunnel: true, proxy: protocol: 'http:',...

CVE-2018-0251

A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer SSL VPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of that portal on an...

CVE-2018-0242

A vulnerability in the WebVPN web-based management interface of Cisco Adaptive Security Appliance could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability

A vulnerability in the Login screen of the Clientless SSL VPN WebVPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Th...

Path Traversal

htmlpublisher is vulnerable to path traversal. User input report names are not further validated and are employed as part of a URL and as a directory name, overriding files outside the build directory...