282 matches found
Hotaru CMS Cross-Site Scripting Vulnerability
Hotaru CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in Hotaru CMS v1.7.2. The vulnerability stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploit this vulnerability to...
CVE-2019-16720
ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file...
ZZZCMS zzzphp input validation error vulnerability
ZZZCMS zzzphp is a content management system CMS. An input validation error vulnerability exists in ZZZCMS zzzphp v1.7.2, which can be exploited by an attacker to execute arbitrary code...
Command Execution Vulnerability in zzzphp V1.7.2 Backend
zzphp is a free website builder developed in PHP language. zzzphp V1.7.2 command execution vulnerability exists in the background, an attacker can exploit the vulnerability to execute arbitrary code...
Security update for icedtea-web (important)
openSUSE Security Update: Security update for icedtea-web Announcement ID: openSUSE-SU-2019:1911-1 Rating: important References: 1142825 1142832 1142835 Cross-References: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185 Affected Products: openSUSE Leap 15.0 An update that fixes three vulnerabilities ...
SUSE-SU-2019:2033-1 Security update for icedtea-web
This update for icedtea-web to version 1.7.2 fixes the following issues: Security issues fixed: - CVE-2019-10181: Fixed an unsigned code injection in a signed JAR file bsc1142835 - CVE-2019-10182: Fixed a path traversal while processing elements of JNLP files results in arbitrary file overwrite...
Gitea 1.7.2 - 1.7.3 XSS Vulnerability
Gitea is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea"; if...
ZZZCMS V1.7.2 version of the background of the existence of arbitrary file reading vulnerability
zzcms is a free and open source building system, mainly facing the majority of webmasters to use. ZZZCMS V1.7.2 there are arbitrary file reading vulnerabilities in the background. An attacker can exploit the vulnerability to read arbitrary files and conduct intranet probes...
Debian DLA-1777-2 : jquery regression update
The minified jquery library was broken in version 1.7.2+dfsg-3.2+deb8u6 due to an error during the build. This problem has now been fixed in version 1.7.2+dfsg-3.2+deb8u7 For Debian 8 'Jessie', this problem has been fixed in version 1.7.2+dfsg-3.2+deb8u7. We recommend that you upgrade your jquery...
Design/Logic Flaw
Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...
OPENSUSE-SU-2019:1166-1 Security update for znc
This update for znc to version 1.7.2 fixes the following issue: Security issue fixed: - CVE-2019-9917: Fixed an issue where due to invalid encoding znc was crashing bsc1130360...
CVE-2018-16493
A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL...
Debian: Security Advisory (DLA-1594-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2018-1000216
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE. This attack appear to be exploitable via Attacker must be able to force victim to print JSON data, depending on how cJSON library is used this could...
Double free
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE. This attack appear to be exploitable via Attacker must be able to force victim to print JSON data, depending on how cJSON library is used this could...
Zulip Server Cross-Site Scripting Vulnerability (CNVD-2018-08600)
Zulip Server is a set of open source group chat application written in Python based on the Django framework . frontend markdown processor is one of the front-end markdown markup language processor . A cross-site scripting vulnerability exists in the frontend markdown processor in Zulip Server...
Cross site scripting
In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead...
CVE-2018-9999
In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...