Text Exploits
31,337 exploits tracked across all sources.
MiCasaVerde VeraLite <1.5.408 - CSRF
Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to hijack the authentication of users for requests that install arbitrary firmware via the squashfs parameter.
by Trustwave's SpiderLabs
CVSS 6.5
INSTEON Hub 2242-222 - No Auth Required
INSTEON Hub 2242-222 lacks Web and API authentication
by Trustwave's SpiderLabs
CVSS 8.1
D-Link DIR-645 Router - XSS
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3) receiver parameter to bsc_sms_send.php.
by Roberto Paleari
Karotz API <12.07.19.00 - Info Disclosure
Karotz API 12.07.19.00: Session Token Information Disclosure
by Trustwave's SpiderLabs
CVSS 5.3
SilverStripe 3.0.3 - CSRF
security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct phishing attacks without detection by the victim.
by Fara Rustein
Plone < 4.1.1 - Access Control
The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the "next" parameter to acl_users/credentials_cookie_auth/require_login.
by Cyrill Bannwart
Jahia xCM 6.6.1.0 - XSS
Multiple cross-site scripting (XSS) vulnerabilities in Jahia xCM 6.6.1.0 before hotfix 7 allow remote attackers to inject arbitrary web script or HTML via (1) the site parameter to engines/manager.jsp, (2) the searchString parameter to administration/ in a search action, or the (3) username, (4) firstName, (5) lastName, (6) email, or (7) organization field to administration/ in a users action.
by High-Tech Bridge
Jahia xCM 6.6.1.0 - XSS
Multiple cross-site scripting (XSS) vulnerabilities in Jahia xCM 6.6.1.0 before hotfix 7 allow remote attackers to inject arbitrary web script or HTML via (1) the site parameter to engines/manager.jsp, (2) the searchString parameter to administration/ in a search action, or the (3) username, (4) firstName, (5) lastName, (6) email, or (7) organization field to administration/ in a users action.
by High-Tech Bridge
WebDisk 3.0.2 PhotoViewer iOS - Command Execution
by Vulnerability-Lab
Private Photos 1.0 iOS - Persistent Cross-Site Scripting
by Vulnerability-Lab
Symantec Web Gateway < 5.1 - OS Command Injection
The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script.
by SEC Consult
Alienvault Open Source SIEM (OSSIM) - Multiple Cross-Site Scripting Vulnerabilities
by xistence
WordPress Duplicator <0.4.5 - XSS
Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter.
by High-Tech Bridge
FOSCAM IP Camera FI8620 - Info Disclosure
An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, which could let a malicious user obtain sensitive information.
by Core Security
CVSS 7.5
XnView <2.04 - RCE
Buffer overflow in XnView before 2.04 allows remote attackers to execute arbitrary code via a crafted PCT file.
by Core Security
Microsoft Windows - Code Injection
DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted GIF file, aka "DirectShow Arbitrary Memory Overwrite Vulnerability."
by Andrés Gómez Ramírez
Artweaver <3.1.6 - Buffer Overflow
Buffer overflow in Artweaver before 3.1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted AWD file.
by Core Security
By Source