Cross-site Scripting (XSS)

Piwik is susceptible to cross-site scripting XSS attacks. The attacks exist because it does not sanitize the user-supplied input...

XSS vulnerability in code example

SECURITY Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The codegenerator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it is explicitly renamed, so it is safe by default. There...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. The library does not properly filter user input in the qualification and rating fields for rubric/advanced grading. This allows a malicious user to inject and execute arbitrary script...

Cross-site Scripting (XSS)

concrete5 is vulnerable to cross-site scripting XSS attacks. The library fails to sanitize user input to bulkupdate.php and sitemapdragrequest.php, allowing a malicious user to inject and execute arbitrary script...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. The library does not properly filter user input to the quizquestiontostring function in mod/quiz/editlib.php, allowing a malicious user to inject and execute arbitrary HTML script...

SQL Injection

Subrion is vulnerable to SQL Injection attacks. The library does not have any checking for user input through the $GET parameter in /front/search.php, allowing a malicious user to inject and execute arbitrary SQL...

Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

CVE-2016-6798

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

CVE-2017-11414

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/syscomment.php via $POST'comment', $POST'name', $POST'web', $POST'email', $POST'status', $POST'id', and $REQUEST'id'...

Sql injection

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/syscomment.php via $POST'comment', $POST'name', $POST'web', $POST'email', $POST'status', $POST'id', and $REQUEST'id'...

Sophos Web Appliance 4.3.0.2 Remote Command Injection

Exploit Title: Sophos Web Appliance reporting JSON trafficType Remote Command Injection Vulnerablity Date: 01/28/2017 Exploit Author: xort @ Critical Start Vendor Homepage: www.sophos.com Software Link: sophos.com/en-us/products/secure-web-gateway.aspx Version: 4.3.0.2 Tested on: 4.3.0.2 CVE :...

Juniper ScreenOS 6.3.x < 6.3.0r24 Multiple XSS (JSA10782)

The version of Juniper ScreenOS running on the remote host is 6.3.x prior to 6.3.0r24. It is, therefore, affected by multiple cross-site scripting XSS vulnerabilities in the web user interface due to improper validation of user-supplied input before returning it to users. An authenticated, remote...

CVE-2017-9338

Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2. To be exploitable a user has to write or paste malicious content into the search dialogue...

Cross site scripting

Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2. To be exploitable a user has to write or paste malicious content into the search dialogue...

Cross-site Scripting (XSS)

candy is vulnerable to cross-site scripting XSS attacks. Text sent by users is not sanitized in any way, allowing attackers to execute JavaScript code...

Security Update for Microsoft SharePoint Server and Project Server (July 2017)

The Microsoft SharePoint Server or Project Server installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in Microsoft Office due to improper handling of objects in memory. An...

PT-2017-2796

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.1.x through 2.3.x Description The issue exists due to insufficient validation of user-input data that is part of a message, allowing a remote attacker to execute arbitrary code. This can be achieved by passing a...

From PhantomJS picture rendering of XSS vulnerabilities to the SSRF/local file read vulnerability-vulnerability warning-the black bar safety net

One, Foreword Recently I was invited to study a vulnerability reward project, this project can be based on user input to generate a picture, in order for users to download. After a period time of exploring, I found a way to exploit the path, you can use the picture inside theXSSthe vulnerability ...

html-social-share-buttons

It is an HTML/CSS/JavaScript library for adding social media sha...

Remote Code Execution (RCE)

struts2-struts1-plugin is vulnerable to remote code execution RCE attacks. These attacks are possible because the user input are not sanitized and are directly passed through messages.add to be used as a part of an error message in the ActionMessage class. This doesn't affect users of the Struts...