CVE-2019-8153

A mitigation bypass to prevent cross-site scripting XSS exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Successful exploitation of this vulnerability would result in an attacker being able to bypass the escapeURL function and execute a malicious XSS payload...

CVE-2018-8153

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access OWA fails to properly handle web requests, aka "Microsoft Exchange Spoofing Vulnerability." This affects Microsoft Exchange Server...

CVE-2018-8153

CVE-2018-8153 affects Microsoft Exchange Server (OWA). The vulnerability arises from Outlook Web Access failing to properly handle web requests, enabling spoofing/content-injection risk and potential user deception. The issue is addressed alongside May 2018 Exchange security updates (KB4092041 fo...

CVE-2018-8153

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access OWA fails to properly handle web requests, aka "Microsoft Exchange Spoofing Vulnerability." This affects Microsoft Exchange Server...

May 2018 Patch Tuesday – Medium Weight, However One Active Exploit Needs Attention

This May's Patch Tuesday has quite a few Microsoft fixes for both the OS and browsers. In all, 67 unique CVEs are addressed in 17 KB articles, with 21 CVEs marked Critical. 32 of these CVEs reference Remote Code Execution, 19 of which are Critical. Those who use Hyper-V have some updates to pay...

Description of the security update for Microsoft Exchange Server 2013 and 2016: May 8, 2018

Description of the security update for Microsoft Exchange Server 2013 and 2016: May 8, 2018 Summary This security update resolves vulnerabilities in Microsoft Exchange. To learn more about these vulnerabilities, see the following Common Vulnerabilities and Exposures CVE: Microsoft Common...

KLA11242 Multiple vulnerabilities in Microsoft Exchange Server

Multiple serious vulnerabilities have been found in Microsoft Exchange Server. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information and spoof user interface. Below is a complete list of vulnerabilities: 1. An improper handling of objects in...

Microsoft Exchange Server CVE-2018-8153 Spoofing Vulnerability

Description Microsoft Exchange Server is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Exchan...

CVE-2017-8153

Huawei VMall (Android) prior to version 1.5.8.5 contains a privilege-elevation vulnerability due to improper design. An attacker can trick a user into installing a malicious app that can send HTTP requests and execute JavaScript in web pages without Internet permission, potentially causing resour...

Security Advisory - Privilege Escalation Vulnerability in Some Huawei APKs

Some Huawei APKs have a privilege elevation vulnerability due to improper design. An attacker can trick users into installing a malicious app which can send out HTTP requests and execute JavaScript code in web pages without obtaining the Internet access permission. Successful exploit could lead t...

CVE-2015-8153

Symantec Endpoint Protection Manager (SEPM) 12.1 prior to RU6-MP4 is affected by CVE-2015-8153 (SQL injection). Interfaces with the SEPM backend allow a remote authenticated attacker to execute arbitrary SQL via unspecified vectors, potentially impacting data confidentiality, integrity, and avail...

Symantec Endpoint Protection Multiple Security Issues

SUMMARY Symantec Endpoint Protection SEP was susceptible to a number of security findings that could potentially result in an authorized but less privileged user gaining elevated access to the Management Console. SEP Client security mitigations can potentially be bypassed allowing arbitrary code...

CVE-2014-8153

The CVE-2014-8153 entry affects the L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2 when using radvd 2.0+. A remote authenticated user can cause a denial of service (blocked router update processing) by creating eight routers and assigning an IPv6 non-provider subnet to each. Connected adv...

SuSE 10 Security Update : net-snmp (ZYPP Patch Number 8153)

This update to net-snmp resolves the following issues : - Specially crafted SNMP GET requests could cause a denial of service application crash via a heap-based out-out-bounds read flaw which could be exploited remotely. CVE-2012-2141 - After rotating the net-snmp log file, use 'try-restart' to...