Quantopian: Cross-site scripting on algorithm collaborator

Hi again my favorite VDP team. I bring you 8th bug and 4th cross-site scripting. Currently trying to upload python code via self-serve data, not looking for XSS'es only, but they're a thing still, right? Summary: By sending specially crafted websockets request attacker can run javascript in...

CVE-2019-12799

Shopware vulnerability CVE-2019-12799 affects the createInstanceFromNamedArguments function in Shopware up to version 5.6.x, where a crafted web request can trigger PHP object instantiation leading to arbitrary deserialization and remote code execution. The issue bypasses a prior whitelist patch ...

SQL Injection Attacks: So Old, but Still So Relevant. Here’s Why (Charts)

We’re living in the Golden Age of data. Some companies analyze it to better themselves, others trade it for profit, none give it up freely due to its value — for their business, and for criminals, as well. SQL Structured Query Language is an extremely popular way to communicate with databases...

lincolnelectric.com Cross Site Scripting vulnerability

Security Researcher OmniGooch Helped patch 3835 vulnerabilities Received 5 Coordinated Disclosure badges Received 10 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting lincolnelectric.com website and its users. Following...

Microsoft Office SharePoint CVE-2019-1031 Cross Site Scripting Vulnerability

Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Malicious Package

github-jquery-widgets contains malicious code. The code when executed in the browser would capture password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

Malicious Package

scroool contained malicious code. The code when executed in the browser would capture password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

Malicious Package

react-datepicker-plus contains malicious code. The code when executed in the browser would capture password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

Malicious Package

radicjs contains malicious code. The code when executed in the browser would get password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

CVE-2018-8047

Vulnerability: vtiger CRM 7.0.1 is affected by a reflected Cross-Site Scripting (XSS) flaw. Root cause: lack of proper input validation in the app parameter passed via index.php?module=Contacts&view=List, enabling remote unauthenticated users to inject script/HTML. Affected versions: 7.0.1 and pr...

CVE-2019-7671

CVE-2019-7671 affects Prima Systems FlexAir (Versions 2.3.38 and earlier). The issue is an authenticated Stored XSS vector where parameters sent to scripts are not properly sanitized, potentially allowing code execution in a user’s browser context. Public PoCs exist (e.g., HwName Stored XSS via P...

Imperva to Acquire Distil Networks, the Leader in Bot Management

As an established leader in cybersecurity, Imperva provides our customers the most comprehensive, analyst-recognized application security solution on the market. We are a five-time leader in Gartner’s 2018 Magic Quadrant for Web Application Firewalls WAF. Our DDoS Protection continues to...

CVE-2019-6743

The CVE-2019-6743 entry relates to Xiaomi Mi6 Browser prior to 10.4.0, with a flaw in WebAssembly.Instance due to improper validation that can cause a heap-based write overflow. This enables remote code execution when a user visits a malicious page or opens a malicious file and requires user inte...

PYSEC-2019-79

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provid...

AUO Solar Data Recorder < 1.3.0 - Incorrect Access Control

Exploit Title: AUO Solar Data Recorder - Incorrect Access Control Date: 2019-04-16 Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO Solar Data Recorder all versions prior to v1.3.0 Tested on: It is a proprietary devices:...

The vulnerability of the Cisco Web Security Appliance’s logging subsystem allows a hacker to execute arbitrary commands and elevate their privileges to the root level.

The vulnerability of the Cisco Web Security Appliance WSA’s reporting subsystem is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary commands and elevate their privileges to the root level...

Web Security Leader Rapidly Expands by Partnering with AWS and Imperva

Companies try to plan and pace their growth. Those plans go out the window when a merger or acquisition happens, as it did to DigiCert Inc. DigiCert, based in Lehi, Utah, had long been a leading Certificate Authority CA, providing electronic documents that verify and authenticate the identities o...

UBUNTU-CVE-2017-18375

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

AUO Solar Data Recorder < 1.3.0 - addr Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: AUO Solar Data Recorder - Stored XSS Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO Solar Data Recorder all versions prior to v1.3.0 Tested on: It is a proprietary devices:...

Acunetix Vulnerability Scanner Now With Network Security Scans

User-friendly and competitively priced, Acunetix leads the market in automatic web security testing technology. Its industry-leading crawler fully supports HTML5, JavaScript, and AJAX-heavy websites, enabling the auditing of complex, authenticated applications. Acunetix provides the only technolo...