PT-2017-3823

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.14.14 Description The issue is related to the pcpu embed first chunk function in the Linux kernel, which allows local users to obtain sensitive address information by reading dmesg data from a "pages/cpu" printk...

Khan Academy: Frameset(Frame) html tag is allowed in html editor.(can lead to clickjacking)

Hello Sir/Mam , I was using the html editor in computer programming section , which allowed me to design a webpage. When i use the iframe tag , object tag and embed tag it show me the message that these tags are not allowed for security reasonsmay be cause of clickjacking attack or something but...

Automattic: Stored XSS Using Media

Hi, Summary: This exploits an XSS vulnerability on polldaddy.com Steps to Reproduce: 1. Create a multiple-choice question quiz on Polldaddy 2. Insert stored XSS payload into Media Embed such that it matches the shortcode format Payload: 3. When someone goes on the quiz page through the quiz share...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), au.com.cybernostics:theme-tree (0.9.0) +1484 more potentially affected by CVE-2017-12617 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.21)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =1.0.0, =1, =1, =1, =1, =1, =0.0.1, =0.1.0, =1.0.0-rc, =0.2.1, =0.1.1, =0.1.2 and more Source cves: CVE-2017-12617 Source advisory: MEND:CVE-2017-12617...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.27) +279 more potentially affected by CVE-2017-12615 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.78)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2017-12615 Source advisory: MEND:CVE-2017-12615...

ch.rasc:embeddedtc (>=2.0, <=2.14), ch.sbb.releasetrain:jsfbootadapter (>=0.0.25, <=0.9.6) +100 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=8.0.1, <=8.0.36)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =8.0.1, =2.0, =0.0.25, =0.0.4, =1.0.0, =1.0.5, =1.0.5, =0.9.1-beta4, =8.0.18.0-m1, =0.3.0, =0.4.2 and more Source cves: CVE-2016-5018 Source advisory: MEND:CVE-2016-5018...

ch.sbb.releasetrain:webui (>=0.0.26, <=0.9.5), com.sdl.dxa.modules:dxa-module-audience-manager-web8 (1.6.0) +26 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=8.5.0, <=8.5.4)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =8.5.0, =0.0.26, =0.0.2, =0.0.1, =0.0.2, =0.0.0, =0.0.0, =0.0.0, =2.1.0, =2.1.0, =2.2.4 and more Source cves: CVE-2016-5018 Source advisory: MEND:CVE-2016-5018...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.26) +62 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=7.0.8, <=7.0.69)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =7.0.8, =0.0.1, =1.0, =1.0, =1.2.1.aghost-fix.20201109, =1.0-release, =1.0-release, =7.0.22, =0.1.0, =1.0, =1.0.b1, =1.0.b11 and more Source cves: CVE-2016-5018 Source advisory: MEND:CVE-2016-5018...

WordPress YouTube Embed Plus plugin <=11.8.1 - Cross-Site Request Forgery (CSRF) vulnerability

WordPress YouTube Embed Plus plugin version 11.8.1 vulnerable to the Cross-Site Request Forgery CSRF vulnerability. This vulnerability allows an attacker to change plugin settings if he manages to trick admin user to follow the forged link. Solution Please update WordPress YouTube Embed plugin to...

metalinjection.net XSS vulnerability

Vulnerable URL: http://metalinjection.net/podcast-embed/mediaplayer.swf?file=http://content.bitsontherun.com/videos/bkaovAYt-364766.flv=falseℑ=http://appsec.ws/ExploitDB/cMon.jpg=true=javascript:confirm/openbugbounty/;//=blank&.swf Details: Description| Value ---|--- Patched:| No Latest check for...

nrk.no XSS vulnerability

Vulnerable URL: https://www.nrk.no/embed/PS271139vvbor"' XANY...

com.aol.microservices:micro-tomcat (>=0.83, <=0.91.11), com.aol.microservices:micro-tomcat-with-jersey (>=0.83, <=0.91.11) +10 more potentially affected by CVE-2017-5651 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.0.m18)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =0.83, =0.83, =0.1.0, =1.0.0, =1.0.0, =1.6-beta.2, =0.9.4, =9.0.0.m1, =9.0.0.m1, =9.0.0.m18 - us.levk:rserve-client 0.0.3 Source cves: CVE-2017-5651 Source advisory: MEND:CVE-2017-5651...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), au.com.cybernostics:theme-tree (0.9.0) +970 more potentially affected by CVE-2017-5651 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.12)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =1.0.0, =1, =1, =1, =1, =1, =0.1.0, =1.0.0-rc, =0.2.1, =0.1.1, =0.1.1, =0.0.26, =0.9.6 and more Source cves: CVE-2017-5651 Source advisory: MEND:CVE-2017-5651...

com.aol.microservices:micro-tomcat (>=0.83, <=0.91.11), com.aol.microservices:micro-tomcat-with-jersey (>=0.83, <=0.91.11) +9 more potentially affected by CVE-2017-5648 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.0.m17)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =0.83, =0.83, =0.1.0, =1.0.0, =1.0.0, =1.6-beta.2, =0.9.4, =9.0.0.m1, =9.0.0.m1, =9.0.0.m17 Source cves: CVE-2017-5648 Source advisory: MEND:CVE-2017-5648...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.27) +277 more potentially affected by CVE-2017-5648 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.75)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 - com.definesys.mpaas:query-weblogic 1.0.0 and more Source cves: CVE-2017-5648 Source advisory: MEND:CVE-2017-5648...

au.com.mountain-pass:hyperstate (>=1, <=9), biz.dfch.j:activiti.wrapper (>=0.0.6, <=0.0.7) +1015 more potentially affected by CVE-2017-5648 via org.apache.tomcat.embed:tomcat-embed-core (>=8.0.1, <=8.0.41)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.0.1, =1, =0.0.6, =0.0.10, =2.0, =0.0.21, =0.0.21, =0.0.21, =0.0.25, =0.0.21, =0.0.21, =0.0.21, =0.0.21, =1.1, =1.1.2 and more Source cves: CVE-2017-5648 Source advisory: MEND:CVE-2017-5648...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), au.com.cybernostics:theme-tree (0.9.0) +970 more potentially affected by CVE-2017-5648 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.12)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =1.0.0, =1, =1, =1, =1, =1, =0.1.0, =1.0.0-rc, =0.2.1, =0.1.1, =0.1.1, =0.0.26, =0.9.6 and more Source cves: CVE-2017-5648 Source advisory: MEND:CVE-2017-5648...

UBUNTU-CVE-2017-6817

In WordPress before 4.7.3 wp-includes/embed.php, there is authenticated Cross-Site Scripting XSS in YouTube URL Embeds...

[SECURITY] Fedora 23 Update: kf5-kross-5.24.0-1.fc23

Kross is a scripting bridge to embed scripting functionality into an application. It supports QtScript as a scripting interpreter backend...

Drupal Node Embed Module Remote Denial of Service Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Node Embed is one of the node modules used to integrate CKEditor's input filters into the content editor and embed them within the body of the article. A remote denial of service...