alchemy-embed-medias (>=0.4.0, <=0.5.0), globe-iframe-resizer (>=0.0.0, <=0.0.2) +4 more potentially affected by CVE-2018-1000086 via pym.js (0.4.5)

pym.js NPM version 0.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on pym.js and may be impacted: - alchemy-embed-medias =0.4.0, =0.0.0, =0.2.1, =0.1.0, =0.3.0, =1.0.0, =4.0.0 Source cves: CVE-2018-1000086 Source advisory: GHSA-82GW-PQF7-Q3J2...

alchemy-embed-medias (>=0.4.0, <=0.5.0), globe-iframe-resizer (>=0.0.0, <=0.0.2) +4 more potentially affected by CVE-2018-1000086 via pym.js (0.4.5)

pym.js NPM version 0.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on pym.js and may be impacted: - alchemy-embed-medias =0.4.0, =0.0.0, =0.2.1, =0.1.0, =0.3.0, =1.0.0, =4.0.0 Source cves: CVE-2018-1000086 Source advisory: MEND:CVE-2018-1000086...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.29) +281 more potentially affected by CVE-2018-1304 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.85)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2018-1304 Source advisory: MEND:CVE-2018-1304...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), au.com.cybernostics:theme-tree (0.9.0) +2067 more potentially affected by CVE-2018-1304 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.27)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =1.0.0, =1, =1, =1, =1, =1, =0.0.1, =0.1.0, =1.0.0-rc, =0.2.1, =0.1.1, =0.1.2 and more Source cves: CVE-2018-1304 Source advisory: MEND:CVE-2018-1304...

au.com.mountain-pass:hyperstate (>=1, <=9), biz.dfch.j:activiti.wrapper (>=0.0.6, <=0.0.7) +1041 more potentially affected by CVE-2018-1304 via org.apache.tomcat.embed:tomcat-embed-core (>=8.0.1, <=8.0.50)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.0.1, =1, =0.0.6, =0.0.10, =2.0, =0.0.21, =0.0.21, =0.0.21, =0.0.25, =0.0.21, =0.0.21, =0.0.21, =0.0.21, =1.1, =1.1.2 and more Source cves: CVE-2018-1304 Source advisory: MEND:CVE-2018-1304...

nz.net.osnz.composite:composite-spring-boot-tomcat (1.2), org.apache.tomcat.embed:tomcat-embed-jasper (>=9.0.1, <=9.0.4) +2 more potentially affected by CVE-2018-1304 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.1, <=9.0.4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.1, =9.0.1, =9.0.1, =2.11.0, =3.8.2 Source cves: CVE-2018-1304 Source advisory: MEND:CVE-2018-1304...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.29) +281 more potentially affected by CVE-2018-1305 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.84)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2018-1305 Source advisory: MEND:CVE-2018-1305...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), au.com.cybernostics:theme-tree (0.9.0) +2067 more potentially affected by CVE-2018-1305 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.27)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =1.0.0, =1, =1, =1, =1, =1, =0.0.1, =0.1.0, =1.0.0-rc, =0.2.1, =0.1.1, =0.1.2 and more Source cves: CVE-2018-1305 Source advisory: MEND:CVE-2018-1305...

com.aol.microservices:micro-tomcat (>=0.83, <=0.91.11), com.aol.microservices:micro-tomcat-with-jersey (>=0.83, <=0.91.11) +15 more potentially affected by CVE-2018-1305 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =0.83, =0.83, =0.1.0, =1.0.0, =1.0.0, =1.6-beta.2, =0.9.4, =9.0.0.m1, =9.0.0.m1, =2.11.0, =3.8.2 - us.levk:rserve-client 0.0.3 and more Source cves: CVE-2018-1305 Source advisory: MEND:CVE-2018-1305...

PT-2017-3823

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.14.14 Description The issue is related to the pcpu embed first chunk function in the Linux kernel, which allows local users to obtain sensitive address information by reading dmesg data from a "pages/cpu" printk...

Khan Academy: Frameset(Frame) html tag is allowed in html editor.(can lead to clickjacking)

Hello Sir/Mam , I was using the html editor in computer programming section , which allowed me to design a webpage. When i use the iframe tag , object tag and embed tag it show me the message that these tags are not allowed for security reasonsmay be cause of clickjacking attack or something but...

Automattic: Stored XSS Using Media

Hi, Summary: This exploits an XSS vulnerability on polldaddy.com Steps to Reproduce: 1. Create a multiple-choice question quiz on Polldaddy 2. Insert stored XSS payload into Media Embed such that it matches the shortcode format Payload: 3. When someone goes on the quiz page through the quiz share...

au.com.mountain-pass:hyperstate (>=1, <=9), biz.dfch.j:activiti.wrapper (>=0.0.6, <=0.0.7) +1024 more potentially affected by CVE-2017-12617 via org.apache.tomcat.embed:tomcat-embed-core (>=8.0.0-rc1, <=8.0.46)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.0.0-rc1, =1, =0.0.6, =0.0.10, =2.0, =0.0.21, =0.0.21, =0.0.21, =0.0.25, =0.0.21, =0.0.21, =0.0.21, =0.0.21, =1.1, =1.1.2 and more Source cves: CVE-2017-12617 Source advisory: MEND:CVE-2017-12617...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), au.com.cybernostics:theme-tree (0.9.0) +1484 more potentially affected by CVE-2017-12617 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.21)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =1.0.0, =1, =1, =1, =1, =1, =0.0.1, =0.1.0, =1.0.0-rc, =0.2.1, =0.1.1, =0.1.2 and more Source cves: CVE-2017-12617 Source advisory: MEND:CVE-2017-12617...

com.aol.microservices:micro-tomcat (>=0.83, <=0.91.11), com.aol.microservices:micro-tomcat-with-jersey (>=0.83, <=0.91.11) +13 more potentially affected by CVE-2017-12617 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.0.m27)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =0.83, =0.83, =0.1.0, =1.0.0, =1.0.0, =1.6-beta.2, =0.9.4, =9.0.0.m1, =9.0.0.m1, =1.2, =1.2, =2.0 Source cves: CVE-2017-12617 Source advisory: MEND:CVE-2017-12617...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.28) +280 more potentially affected by CVE-2017-12617 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.81)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2017-12617 Source advisory: MEND:CVE-2017-12617...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.27) +279 more potentially affected by CVE-2017-12615 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.78)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2017-12615 Source advisory: MEND:CVE-2017-12615...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.26) +62 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=7.0.8, <=7.0.69)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =7.0.8, =0.0.1, =1.0, =1.0, =1.2.1.aghost-fix.20201109, =1.0-release, =1.0-release, =7.0.22, =0.1.0, =1.0, =1.0.b1, =1.0.b11 and more Source cves: CVE-2016-5018 Source advisory: MEND:CVE-2016-5018...

ch.rasc:embeddedtc (>=2.0, <=2.14), ch.sbb.releasetrain:jsfbootadapter (>=0.0.25, <=0.9.6) +100 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=8.0.1, <=8.0.36)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =8.0.1, =2.0, =0.0.25, =0.0.4, =1.0.0, =1.0.5, =1.0.5, =0.9.1-beta4, =8.0.18.0-m1, =0.3.0, =0.4.2 and more Source cves: CVE-2016-5018 Source advisory: MEND:CVE-2016-5018...

ch.sbb.releasetrain:webui (>=0.0.26, <=0.9.5), com.sdl.dxa.modules:dxa-module-audience-manager-web8 (1.6.0) +26 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=8.5.0, <=8.5.4)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =8.5.0, =0.0.26, =0.0.2, =0.0.1, =0.0.2, =0.0.0, =0.0.0, =0.0.0, =2.1.0, =2.1.0, =2.2.4 and more Source cves: CVE-2016-5018 Source advisory: MEND:CVE-2016-5018...