Cross site scripting

Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page...

CVE-2019-1010314

Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page...

F5 BIG-IP Access Control Error Vulnerability (CNVD-2019-32032)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An access control error vulnerability exists in F5 BIG-IP, which can be exploited by an attacker to overwrite arbitrary files...

UBUNTU-CVE-2019-5052

An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. An attacker can provide a...

GHSA-28HP-FGCR-2R4H Cross-Site Scripting via JSONP

JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors...

PT-2019-19990

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue allows untrusted resource URLs, providing a vector for attack by malicious actors. No information is available about the estimated number of potentially affected devices or...

Sohu Video Player suffers from dll hijacking vulnerability

Sohu Video Player is an online network video player officially launched by Sohu. Sohu Video Player has a dll hijacking vulnerability, which can be exploited by attackers to load a malicious dll and execute malicious code...

CVE-2019-3787

Cloud Foundry UAA vulnerability CVE-2019-3787 affects UAA releases prior to v73.0.0. When a user email is not provided or the username lacks an @, UAA falls back to appending unknown.org to the email, which means password-recovery emails can be sent to an owned domain. This creates a potential ta...

Spring Security OAuth - Open Redirector Vulnerability

Exploit for java platform in category web applications Exploit Title: Open Redirector in spring-security-oauth2 Exploit Author: Riemann Vendor Homepage: https://spring.io/projects/spring-security-oauth Software Link: https://spring.io Version: Spring Security OAuth versions 2.3 prior to 2.3.6...

Spring Security OAuth - Open Redirector

Spring Security OAuth - Open Redirector Exploit Title: Open Redirector in spring-security-oauth2 Date: 17 June 2019 Exploit Author: Riemann Vendor Homepage: https://spring.io/projects/spring-security-oauth Software Link: https://spring.io Version: Spring Security OAuth versions 2.3 prior to 2.3.6...

Pronestor Health Monitoring 8.1.11.0 - Privilege Escalation Vulnerability

Exploit for windows platform in category local exploits Pronestor Health Monitoring sc qc PNHM SERVICENAME: PNHM TYPE : 10 WIN32OWNPROCESS STARTTYPE : 2 AUTOSTART ERRORCONTROL : 1 NORM...

Pronestor Health Monitoring Privilege Escalation

Summary The Pronestor service "PNHM" aka Health Monitoring or HealthMonitor before 8.1.12.0 has "BUILTIN\Users:IF" permissions for the "%PROGRAMFILESX86%\proNestor\Outlook add-in for Pronestor\PronestorHealthMonitor.exe" file, which allows local users to gain privileges via a Trojan horse...

S3 Ransomware Part 1: Attack Vector

The post S3 Ransomware Part 1: Attack Vector appeared first on Rhino Security Labs...

Smart Bluetooth door locks are vulnerable to logic flaws

Beijing Xiyou Information Technology Co., Ltd. is a company that provides online operation and management platform and offline intelligent service solutions for spaces, parks and commercial buildings. A logic flaw vulnerability exists in smart Bluetooth door locks, which can be exploited by...

PT-2019-11722 · Jenkins · Jenkins Artifactory Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Artifactory Plugin versions 3.2.2 and earlier Description: A cross-site request forgery issue allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturin...

CVE-2017-15652

Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected function, affected executable, affected libga imagemagick used that. The attack vector is: Someone must open a postscript file though...

CVE-2017-15652

Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected function, affected executable, affected libga imagemagick used that. The attack vector is: Someone must open a postscript file though...

Cross site scripting

An issue was discovered in Joomla! before 3.9.6. The debug views of comusers do not properly escape user supplied data, which leads to a potential XSS attack vector...

Fortinet FortiClient Code Execution Vulnerability

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance and two-factor authentication when connected to a FortiGate firewall appliance. A security vulnerability exists in Fortinet FortiClient...

Memory corruption

nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function...