14355 matches found
Security Update for Microsoft SharePoint Server and Project Server (July 2017)
The Microsoft SharePoint Server or Project Server installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in Microsoft Office due to improper handling of objects in memory. An...
PT-2017-2796
Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.1.x through 2.3.x Description The issue exists due to insufficient validation of user-input data that is part of a message, allowing a remote attacker to execute arbitrary code. This can be achieved by passing a...
From PhantomJS picture rendering of XSS vulnerabilities to the SSRF/local file read vulnerability-vulnerability warning-the black bar safety net
One, Foreword Recently I was invited to study a vulnerability reward project, this project can be based on user input to generate a picture, in order for users to download. After a period time of exploring, I found a way to exploit the path, you can use the picture inside theXSSthe vulnerability ...
html-social-share-buttons
It is an HTML/CSS/JavaScript library for adding social media sha...
Remote Code Execution (RCE)
struts2-struts1-plugin is vulnerable to remote code execution RCE attacks. These attacks are possible because the user input are not sanitized and are directly passed through messages.add to be used as a part of an error message in the ActionMessage class. This doesn't affect users of the Struts...
Open-Xchange (OX) App Suite Cross Site Scripting Vulnerability (Jul 2017)
Open-Xchange OX App Suite is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Code Execution Vulnerability in Knowledge Reader cajviewer
CAJViewer Reader is a specialized full-text format reader for China Journal Network. A code execution vulnerability exists in the KnowledgeNet Reader CAJViewer due to the program failing to adequately copy user-supplied data into a buffer. An attacker can exploit this vulnerability to execute...
IBM DB2 9.7 < FP11 Special Build 36621 / 10.1 < FP6 Special Build 36610 / 10.5 < FP8 Special Build 36605 / 11.1.2 < FP2 Multiple Vulnerabilities (Windows)
According to its version, the installation of IBM DB2 on the remote Windows host is either 9.7 prior to Fix Pack 11 Special Build 36621, 10.1 prior to Fix Pack 6 Special Build 36610, 10.5 prior to Fix Pack 8 Special Build 36605, or 11.1.2 prior to Fix Pack 2. It is, therefore, affected by the...
Symantec Messaging Gateway 10.x < 10.6.3-266 Multiple Vulnerabilities (SYM17-004)
According to its self-reported version number, the Symantec Messaging Gateway SMG running on the remote host is 10.x prior to 10.6.3-266. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists when handling email attachments involving malformed o...
Grab: CSV Injection https://hub.grab.com
@Poison had pointed out that it was possible to perform CSV Injection on hub.grab.com which was tested on Microsoft Excel 2016. Injection occurred by adding the payload in customer name field in Grab mobile application. The payload used was =cmd|' /C calc'!A0. We fixed this issue by properly...
Check_MK 1.2.4 < 1.2.4p4 / 1.2.5 < 1.2.5i4 Multiple Vulnerabilities
The version of CheckMK running on the remote web server is 1.2.4 prior to 1.2.4p4 or 1.2.5 prior to 1.2.5i4. It is, therefore, affected by multiple vulnerabilities : - Multiple cross-site script XSS vulnerabilities exist in the multisite component, specifically within the renderstatusicons functi...
Cisco Prime Infrastructure DOM Cross-Site Scripting Vulnerability (cisco-sa-20170621-piepnm4)
A vulnerability in the web-based management interface of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to conduct a Document Object Model DOM based environment or client-side cross-site scripting XSS attack against a user of the web-based management interface of an...
Cisco Prime Infrastructure Reflected Cross-Site Scripting Vulnerability (cisco-sa-20170621-piepnm3)
A vulnerability in the web-based management interface of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. SPDX-FileCopyrightText: 2017...
Cisco Prime Infrastructure and Evolved Programmable Network Manager Reflected Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an...
Cisco Firepower Management Center Stored Cross-Site Scripting Vulnerability
A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affected...
Cross-site Scripting (XSS)
github.com/gogits/gogs is vulnerable to cross-site scripting XSS attacks. The library's wiki templates do not sanitize user input, allowing a malicious user to inject and execute arbitrary code...
Microsoft Windows 'olecnv32.dll' Remote Code Execution Vulnerability (KB4025218)
This host is missing a critical security update according to Microsoft KB4025218 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Microsoft SharePoint CVE-2017-8514 Cross Site Scripting Vulnerability
Description Microsoft SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...
