Cross site scripting

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

CVE-2023-25827 Cross-site Scripting in OpenTSDB

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

CVE-2018-25032 affecting package tcl for versions less than 8.6.13-1

CVE-2018-25032 affecting package tcl for versions less than 8.6.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2018-25032 affecting package boost for versions less than 1.76.0-3

CVE-2018-25032 affecting package boost for versions less than 1.76.0-3. A patched version of the package is available...

CVE-2018-25032 affecting package nmap for versions less than 7.93-1

CVE-2018-25032 affecting package nmap for versions less than 7.93-1. An upgraded version of the package is available that resolves this issue...

Hackers Exploiting 5-year-old Unpatched Vulnerability in TBK DVR Devices

Threat actors are actively exploiting an unpatched five-year-old flaw impacting TBK digital video recording DVR devices, according to an advisory issued by Fortinet FortiGuard Labs. The vulnerability in question is CVE-2018-9995 CVSS score: 9.8, a critical authentication bypass issue that could b...

Hackers Exploiting 5-year-old Unpatched Vulnerability in TBK DVR Devices

Threat actors are actively exploiting an unpatched five-year-old flaw impacting TBK digital video recording DVR devices, according to an advisory issued by Fortinet FortiGuard Labs. The vulnerability in question is CVE-2018-9995 CVSS score: 9.8, a critical authentication bypass issue that could b...

PT-2023-11231 · Undefined · Undefined

Хакеры эксплуатируют уязвимость пятилетней давности, взламывая видеокамеры в банках Исследователи Fortinet FortiGuard Labs предупреждают, что злоумышленники активно эксплуатируют критическую неисправленную уязвимость, влияющую на устройства цифровой видеозаписи DVR TBK. Недостаток, отслеживаемый...

Oracle Linux 7 : docker-engine (ELSA-2019-4598)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2019-4598 advisory. - Docker Engine before 18.09 allows attackers to cause a denial of service dockerd memory consumption via a large integer in a --cpuset-mems or --cpuset-cpus...

CVE-2018-25085

creationtimestamp| type| source ---|---|--- 2023-05-01 12:29:19+00:00| seen| https://t.me/cibsecurity/63119...

CVE-2018-9132

creationtimestamp| type| source ---|---|--- 2023-05-01 07:44:06+00:00| seen| https://t.me/VulnerabilityNews/33143...

CVE-2018-20427

creationtimestamp| type| source ---|---|--- 2023-05-01 07:44:06+00:00| seen| https://t.me/VulnerabilityNews/33143...

CVE-2018-25085

CVE-2018-25085 affects Drupal’s Responsive Menus module (7.x-1.x-dev), specifically the function responsive_menus_admin_form_submit in the file responsive_menus.module. The vulnerability enables cross-site scripting and can be exploited remotely via the affected component. The issue is addressed ...

CVE-2018-25085 Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit cross site scripting

A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. Affected by this vulnerability is the function responsivemenusadminformsubmit of the file responsivemenus.module of the component Configuration Setting Handler. The manipulation leads to cross site...

Adobe ColdFusion Unauthenticated Arbitrary File Read

This module exploits a remote unauthenticated deserialization of untrusted data vulnerability in Adobe ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier, in order to read an arbitrary file from the server. To run this module you must provide a valid ColdFusion...

Potential leak of authentication data to 3rd parties

Impact Users of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: 1. Send any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler 2. The target...

K000133668: Python urllib3 vulnerability CVE-2018-20060

Security Advisory Description urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or...

K000133652: Python vulnerability CVE-2018-18074

Security Advisory Description The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. CVE-2018-18074 Impact Fo...

EulerOS Virtualization 2.9.1 : binutils (EulerOS-SA-2023-1620)

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches...

EulerOS Virtualization 2.9.0 : binutils (EulerOS-SA-2023-1654)

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches...