CVE-2019-14551

Technical details (affected product, versions, root cause, exploit specifics) are not publicly provided in the connected documents; monitor for updates.

Malvertising: Online advertising's darker side

By Nick Biasini, Chris Neal and Matt Valites. Executive summary One of the trickiest challenges enterprises face is managing the balance between aggressively blocking malicious advertisements aka malvertising and allowing content to remain online, accessible for the average user. The days of...

madcowtshirt.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-925187 Security Researcher Implosion Helped patch 1643 vulnerabilities Received 7 Coordinated Disclosure badges Received 29 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting madcowtshirt.com website...

Prima Systems FlexAir

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Prima Systems Equipment: FlexAir Vulnerabilities : OS Command Injection, Unrestricted Upload of File with Dangerous Type, Cross-site Request Forgery, Small Space of Random Values, Cross-site...

Cross-site scripting in CLEditor

Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting XSS. The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a lin...

quignon.co.jp Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-920526 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting quignon.co.jp website and its...

oneandone.com.cn Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-913505 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting oneandone.com.cn website and...

Cisco Wireless Controller 3.6.10E - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Product : Cisco Wireless Controller Version : 3.6.10E last version Vendor Homepage: https://www.cisco.com Exploit Author: Mehmet Önder Key Website: htts://cloudvist.com Description : The application interface allows users to perform certa...

Arbitrary File Deletion, Code Execution Vulnerabilities in ICMS

ICMS is a high content management system built with PHP and MySQL. ICMS suffers from an arbitrary file deletion, code execution vulnerability. An attacker can exploit this vulnerability to delete arbitrary files and gain control of the website...

CVE-2018-18673

GNUBOARD5 5.3.1.9 contains a Cross‑Site Scripting (XSS) flaw in the adm/menu_list_update.php me_link parameter (Menu Link). This allows remote attackers to inject arbitrary web script/HTML. Public details consistently reference the same vulnerability across multiple feeds; no exploit specifics ar...

CVE-2019-11715

CVE-2019-11715: HTML parsing error can contribute to content XSS. Affected: Firefox ESR <60.8, Firefox <68, Thunderbird

Cloud Foundry UAA Input Validation Error Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry cloud platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry UAA versions prior to 73.4.0 that stems from the program not setting the X-FRAME-OPTIONS...

Web Security Dog (Apache Edition) V4.0.23957 suffers from SQL Injection Vulnerability

Website Security Dog Apache Edition is a server tool that integrates website content security protection, website resource protection and website traffic protection features. Web Security Dog Apache Edition V4.0.23957 suffers from a SQL injection vulnerability. An attacker can exploit this...

Cisco Web Security Appliance Privilege Escalation Vulnerability

According to its self-reported version, Cisco Web Security Appliance WSA is affected by following vulnerability - A vulnerability in the log subscription subsystem of the Cisco Web Security Appliance WSA could allow an authenticated, local attacker to perform command injection and elevate...

CVE-2019-1010113

Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting XSS. The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a lin...

CVE-2019-1010113

The CVE-2019-1010113 entry concerns Premium Software CLEditor 1.4.5 and earlier, specifically a Cross-Site Scripting (XSS) vulnerability in the jQuery plug‑in. The attacker can inject arbitrary HTML and script code into a target site, via a crafted href on a link (A) element. The attack requires ...

CVE-2019-13971

OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request...

Web Ofisi Emlak 3 - (emlak_durumu) SQL Injection Vulnerability

Exploit for linux platform in category web applications Exploit Title: Web Ofisi Emlak 3 - 'emlakdurumu' SQL Injection Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/emlak-scripti-v3.html Demo Site: http://demobul.net/emlakv3/ Version: V2 Tested on: Kali Linux CVE: N/A...

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser, related to errors in memory object handling, allows attackers to execute arbitrary code.

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser is related to errors in memory object handling. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created web page...

The vulnerability of the SSL traffic decryption function of Cisco Web Security Appliance lies in insufficient verification of server Secure Sockets Layer certificates. This allows attackers to trigger a service failure.

The vulnerability of the SSL traffic decryption function in Cisco Web Security Appliance relates to insufficient verification of Secure Sockets Layer server certificates. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by installing incorrectly generated...