CVE-2015-5060

Cross-site scripting XSS vulnerability in anchor-cms before 0.9-dev...

CVE-2015-5060

CVE-2015-5060 is an XSS vulnerability in anchor-cms prior to version 0.9-dev. The CNVD entry confirms the issue affects anchor-cms with an open XSS flaw that allows a remote attacker to inject arbitrary script/HTML. The NVD record reiterates the vulnerability as a cross-site scripting flaw in anc...

CVE-2015-5060

Cross-site scripting XSS vulnerability in anchor-cms before 0.9-dev...

"Missing intermediate certificates or root anchor" While Scanning Vulnerablity of MDM IP

While customer uses 3rd-party security scanner to scan MDM IP, there is warning:"Missing intermediate certificates or root anchor"...

PT-2017-6811

Name of the Vulnerable Software and Affected Versions anchor-cms versions prior to 0.9-dev Description The issue is related to a cross-site scripting XSS vulnerability. Cross-site scripting is a type of security vulnerability that occurs when an attacker is able to inject malicious scripts into a...

CVE-2015-5060: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in anchor-cms before 0.9-dev...

Cross-Site Scripting (XSS)

anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. The attacks exists because write function in system/cookie.php does not enforce the HttpOnly header when creating cookies...

Cross-Site Scripting (XSS)

anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. These attacks are possible because the comment output from commenttext is not filtered and encoded properly, allowing a malicious user to inject and execute arbitrary web script through it...

Monero: TabNabbing issue (due to taget=_blank)

Hi team, i get to know in this particular url https://getmonero.org/get-started/what-is-monero/ and i found one 3rd party url. Issue lies Here : Here i can see you are using target=blank and no more rel tag. Here , target=blank means it will open in another new tab. but due to tabnabbing it can...

Cross-Site Scripting (XSS)

anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. The attacks are possible because 404 errors and uncaught exception error are not filtered and encoded properly, allowing a malicious user to inject and execute arbitrary web script through a URI...

CVE-2017-11173

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

CVE-2017-11173

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

UBUNTU-CVE-2017-11173

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

CVE-2017-11173

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

DEBIAN-CVE-2017-11173

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

CVE-2017-11173

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

CVE-2017-11173: Undefined Security Weakness

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

bind security and bug fix update

32:9.9.4-50.1 - Bump again above RHEL-7.4 32:9.9.4-38.5 - Fix CVE-2017-3142 and CVE-2017-3143 32:9.9.4-38.4 - Update root servers and trust anchor 1459649...

CVE-2017-8794

An issue was discovered on Accellion FTA devices before FTA912180. Because a regular expression intended to match local https URLs lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwdhttps:// URL pattern...

iOS DEP enrollment may fail when updating the trusted anchor certificates used to trust the SSL connection to the MDM server

After you enable iOS bulk enrollment, the upgrade of the trusted anchor certificates may cause the iOS DEP enrollment or re-enrollment failure. The issue may occur when you change from a self-signed certificate to a public certificate, purchase a certificate from a new provider, or move to an...