1063 matches found
CVE-2014-8338
Cross-site scripting XSS vulnerability in vwrooms/js/jsor-jcarousel/examples/specialtextscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote attackers to inject arbitrary web script or HTML via a URL to a crafted SVG file in the feed parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in vwrooms/js/jsor-jcarousel/examples/specialtextscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote attackers to inject arbitrary web script or HTML via a URL to a crafted SVG file in the feed parameter...
CVE-2014-8338
CVE-2014-8338 – details available Affected software: VideoWhisper Webcam plugins for Drupal 7.x, specifically the file vwrooms/js/jsor-jcarousel/examples/special_textscroller.php. Vulnerability: Cross-site Scripting (XSS) via a crafted SVG file supplied in the feed parameter. The vulnerability or...
CVE-2014-8338
Cross-site scripting XSS vulnerability in vwrooms/js/jsor-jcarousel/examples/specialtextscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote attackers to inject arbitrary web script or HTML via a URL to a crafted SVG file in the feed parameter...
Part II: Returning to Adobe Reader symbols on macOS
Posted by Mateusz Jurczyk, Project Zero In a blog post titled "The story of Adobe Reader symbols" published in October 2019, I presented an analysis of the debug symbols shipped with some older versions of Adobe Reader for Unix-family systems released between 1997-2013. Such symbols can prove...
CVE-2020-8091
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname...
Privilege escalation
An issue was discovered in Gallagher Command Centre 7.x before 7.90.991MR5, 8.00 before 8.00.1161MR5, and 8.10 before 8.10.1134MR4. External system configuration data used for third party integrations such as DVR systems were logged in the Command Centre event trail. Any authenticated operator wi...
CVE-2019-9675
An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phartarwriteheadersint in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue...
PT-2019-15906 · Artica · Pandora Fms
Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 7.x Description: The issue allows for remote code execution with an authenticated user who has the ability to modify the alert system, potentially enabling the execution of commands as root or Administrator. It is noted...
Red Hat JBoss Enterprise Application Platform 7.x < 7.2.5 Multiple Vulnerabilities
The version of Red Hat JBoss Enterprise Application Platform EAP installed on the remote host is 7.x prior to 7.2.5. It is therefore, affected my multiple vulnerabilities as referenced in the RHSA-2019:4021 advisory: - undertow: HTTP/2: large amount of data requests leads to denial of service...
Views Dynamic Fields Code Issue Vulnerability
Drupal is the Drupal community of a set of open source content management system developed using the PHP language . Views Dynamic Fields is used in one of the field filtering display module . A code issue vulnerability exists in Drupal Views Dynamic Fields 7.x-1.0-alpha4 and earlier versions for...
CKEditor Information Disclosure Vulnerability
Drupal is an open source content management system developed by the Drupal community using the PHP language.CKEditor is one of the WYSIWYG editor modules used in... An information disclosure vulnerability exists in CKEditor version 7.x-1.4 for Drupal. The vulnerability stems from errors such as...
CVE-2019-14909
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none LDAP anonymous bind, any password, invalid or valid will be accepted...
Default credentials
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none LDAP anonymous bind, any password, invalid or valid will be accepted...
CVE-2019-14909
CVE-2019-14909 concerns Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind). The issue permits any password (invalid or valid) to be accepted during LDAP authentication, effectively bypassing login checks for that federation. This is described across multiple vulne...
PT-2019-4632 · Red Hat · Keycloak
Name of the Vulnerable Software and Affected Versions: Keycloak versions 7.x Description: A vulnerability was found in Keycloak when configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server, allowing user authentication to succeed even with an invalid...
CVE-2019-14910
A flaw was found in keycloak 7.x where an invalid password is accepted for user authentication when LDAP user federation and STARTTLS is used instead of SSL/TLS from the LDAP server. This can allow an attacker to log into a system using any entry for a password authentication and still gain acces...
IBM Spectrum Protect CVE-2019-4406 Local Denial of Service Vulnerability
Description IBM Spectrum Protect is prone to local denial-of-service vulnerability. Successful exploits will allow local attackers to cause a denial-of-service conditions. Technologies Affected IBM Spectrum Protect 7.1.0.0 IBM Spectrum Protect 7.1.6.6 IBM Spectrum Protect 7.1.6.7 IBM Spectrum...